dns.dnssec

validate_dnskey_rrset(dnskey_records, dnskey_rrsigs, ds_records) -> ok, err

Validate a DNSKEY RRset using DS records (DS → KSK → RRSIG chain)