[dns-operations] DNSSEC validation failures for .KE

[Stephane Bortzmeyer]

On Tue, Mar 31, 2015 at 01:37:51PM +0200,
 Anand Buddhdev <anandb at ripe.net> wrote 
 a message of 25 lines which said:

> Their current DS record points to a key that has the revoke bit set,
> but it is no longer signing the DNSKEY rrset.

There are other problems:

* 10 (!) DNSKEY which seems too many
* lame delegations to mzizi.kenic.or.ke