Re: KSK-2017 SUAs

[Robert Edmonds <edmonds@debian.org>]

Adam D. Barratt wrote:
> Hi,
> 
> It's not clear whether there will have been a stretch point release
> before the KSK rollover in October, but there definitely won't have
> been a jessie point release, and in any case we need to update unbound
> in the next couple of days (to avoid new installs on stretch having
> broken DNSSEC validation for the next month).
> 
> Assuming I've not missed any packages that have been updated, we need
> four SUAs. I've included draft text for each below - review, comments
> and suggestions welcome.

Hi, Adam:

Thanks for writing these! The text mostly looks good to me. The only nit
I have is that I would write "The keys used to authenticate the root DNS
zone" instead of "The keys used to [sign] the root DNS zone[s]".
Technically, there is a chain of signatures and the KSKs do not directly
sign the root zone, and there is only a singular root zone.

-- 
Robert Edmonds
edmonds@debian.org