<html><body><div dir="ltr"><<Sure, the cost of replacing NSEC and NSEC3 would be another resource record type code roll (such as 5->8, RSA-SHA1 vs RSA-SHA1-NSEC3). But a new on-the-fly denial of existence might prove to be worth it in operations.>></div>
<br><div dir="ltr">Well, we are overdue for starting over on dnssec, which we used to do every two years or so. But does the next generation have the will to do so?</div>
<br><div dir="ltr">p vixie</div>
</body></html>