This allows us to query for the root zone DNSKEY RRset and validate it, thus automatically handling KSK rollover.