[DNSOP] Re: Sanity tl;dr for Multi-algorithm DNSSEC Requirements

[Philip Homburg <[e-mail]>]

> So what?  While the root will be an issue EVERY other zone goes
> INSECURE as people migrate to new algorithms and lookups DO NOT
> FAIL.  This is how DNSSEC was designed to work.  To have GRACEFUL
> fallback with old validators.
> 
> This attempt to break the bargain we made with the world is WRONG.
> It is bad engineering.

I think it is very bad idea for security protocols if software that it at
least a decade out of date and that has marginal (remaining) deployment
can block useful progress.

Whether and how to sign is a decision of the zone owner.
There is no requirement to sign is a way that is incompatible with those
old validators. It is just that we should allow a zone owner to say:
we don't care about people running obsolete security software. The people
using that software can turn it off if they can't update.