ルートゾーンKSK/ICANN/verisignについて、ここに記述してください。
Duane Wessels https://blog.verisign.com/domain-names/root-zone-ksk-rollover-postponed/
One missing piece, however, was a way to tell whether or not a population of DNSSEC validating resolvers had successfully updated their trust anchors.
These validators appear to still have only the old KSK and are not accepting the new KSK into their trust anchor set. These represent six to eight percent of the population providing data, a figure we first shared with ICANN in late August.