@oldsysops There are different opinions on whether it is a good idea to rotate the KSK but nobody said it should be required (the root changed its KSK only once since it was signed).

@oldsysops @bortzmeyer The idea of splitting KSK/ZSK (not sole way possible, `uk` was CSK for a long time, aka a single key) is to follow with "security" guidelines that, since all signatures can be recorded, that gives huge amount of data for cryptanalysis and as such changing the keys "often" is good. With ZSK it is easy to change as often as you want or close to that (typically weeks/few months). With KSK, bigger problem (because parent involvement) but usually every couple of years. 1/x

@oldsysops @bortzmeyer For another perspective look at the defaults in new Cascade DNSSEC tool by @nlnetlabs at https://github.com/NLnetLabs/cascade/pull/71/files : KSK/CSK rotation ~= yearly, ZSK rotation ~= monthly, signatures ~= half-month