‘You nailed it,’ says Trusty.

During the ceremony, trusted individuals sign the DNSKEY RRset, creating a new RRSIG record. This new signature allows resolvers worldwide to verify authenticity.