This allows us to query for the root zone DNSKEY RRset and validate
it, thus automatically handling KSK rollover.