[yuhong]

I think DNSSEC already deals with this by offline signing another key that actually signs the DNS root zone.