> I'm not sure why you're making such a big distinction of "TAR" or not. > This seems a rather artificial distinction to me... What I think a > resolver should want to know is if the DNSKEYs it sees for a zone are > those actually being served by that zone? no.