[dd] DS pinning for secondaries

[Petr Špaček <[e-mail]>]

Hello fellow DELEGators.

Today I've presented DELEG work to CENTR Tech group [1] and there was a 
request to support use-case where ALIAS points to secondaries who are 
supposed to serve signed version of the zone, but cannot resign it 
themselves.

In my mind that translates to syntax like this:

signed.example.net. DELEG 0 operator.example. ds="12345678"

This syntax would **enforce** ds= parameter value for a given 
delegation. If ds= is specified in operator.example. subtree it should 
fail. E.g. this would cause SERVFAIL:

signed.example.net. DELEG 0 operator.example. ds="12345678"
operator.example. SVCB ns1.operator.example. ds="66666666"

And this should be validated using DS 12345678:
signed.example.net. DELEG 0 operator.example. ds="12345678"
operator.example. SVCB ns1.operator.example.

Opinions?

[1] https://centr.org/

-- 
Petr Špaček