[mcesch]

OpenDNSSEC's first release was before the root was signed so perhaps there's some assumptions in it that need revisiting.