> > verisigninc.com/DNSKEY: DS RRs exist for algorithm(s) 8 in the com > > zone, but no matching DNSKEYs of algorithm(s) 8 were used to sign > > the verisigninc.com DNSKEY RRset. Indeed, the DS goes to key 24570, while the DNSKEY RRset is signed only with KSK 64326 and ZSK 48824. Nice DNSviz graph.