[bewaretheirs]

it's not a blog - it's a DNSSEC validator tool that gives you a pretty diagram of which keys are signing what.

There are others around which I won't link to right now lest they get clobbered too.