RFC 4641 apparently has no advice about DNSSEC signature lifetimes. I just discovered that ietf.org has signatures valid until May 2011... Isn't it too long? What signature lifetime do people suggest?