[dns-operations] Few questions regarding DNSSEC

[staticsafe]

I have recently started signing all of my domains that I possibly can. I 
have a couple of questions.

1) Are there any recommendations on how often keys should be rotated? 
Best practices to perform during the rotation process?

2) I have a zone ircops.org delegated to my own NSes, in it there is a 
sub-zone dnsbl.ircops.org delegated to other nameservers. Does 
dnsbl.ircops.org need to be signed with the same key(s) as ircops.org?

Thank you for your answers. References to reading materials are much 
appreciated.

-- 
staticsafe
O< ascii ribbon campaign - stop html mail - www.asciiribbon.org
Please don't top post. It is not logical.
Please don't CC me! I'm subscribed to whatever list I just posted on.