[DNSOP] Updated KSK Sentinel document

[Warren Kumari <[e-mail]>]

<author hat only>

Hi all,

Sorry it has taken so long to get a new version of this document
posted - you deserve better.

Anyway, we've finally posted an updated version -
https://datatracker.ietf.org/doc/draft-ietf-dnsop-kskroll-sentinel/

This version includes a (hopefully easily understood) description of
how this would actually be used, and not just "here's a protocol, k,
thnx, bye!". I've tried to layout what each party does, and how it all
fits together - please let me know if it isn't clear. This section is
towards the top of the document - we will likely make it an Appendix
before publication.

I've also updated it to use the kskroll-sentinel-is-ta-<id> format. It
is easy to change again in the future, but this seemed to be what the
working group liked. I also updated my demo implementation
(http://www.ksk-test.net) to use this naming scheme.

This version also clarifies that the test is "Is the Key ID a DNSSEC
root KSK?" Originally my view was that it should be "Is there *any*
key in the trust store with this keyID?", but after running some
numbers I decided that there is a significant chance of false
positives.

As I mentioned, it took an embarrassingly long time to post the update
- please let us know if we missed your comments.

W
-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf