On 23/09/2014 12:22, Chris Thompson wrote:
> On Sep 17 2014, Graham Clinch wrote:
>
> [...snip...]
>> dnssec-dnskey-kskonly seems to split the community - Cambridge,
>> Leicester & Loughborough appear to have it set, Bath (SWURCC) & Imperial
>> do not.

I meant to reply to this - the only reason we don't have it set is I 
didn't know about the option. The logic for setting it is sound, and if 
I get a chance to test it I'll transition us.

ISTM ISC could change the bind default here, sensibly.