This session is about turning DNSSec support on out-of-the-box in the bind9 package. One of the issues in doing this is setting up the initial key, which could get changed during the life of the LTS release. How do we deal with key rotation in new installs?