[dns-wg] revised text for NTIA response - v4

> 10. The organization that generates the root zone file must sign the
> file and therefore must hold the private part of the zone signing key.
>
> or
>
> 10. The organization that generates the root zone file must have
> unfettered access to the zone signing key components.

The second version seems to exclude storing the ZSK in an HSM.  The
first version is more ambiguous.  In both cases, I don't quite see
what the statement is supposed to mean.  Does it advise against the
introduction of yet another layer of indirection, by requiring that
the organization which makes the final, technical content decision on
the root zone (the "generator") also creates the digital signatures?

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99