https://www.systemtek.co.uk/2017/08/dnssec-key-signing-key-rollover/