On 24 Aug 2026, at 16:51, Philip Homburg <[email protected]> wrote:
> As far as I can tell, the local validation policies and the multi-signer > drafts conflict when they are applied to the same algorithm. I think if local validation policies (of whatever shape and colour) didn't conflict they wouldn't be meaningfully-local policies. So I agree, that is our starting point. > Imagine an algorithm PQ1 that is considered UNIVERSAL and a validator that > has a local policy that strictly prefers PQ1 over ECDSA (which is also > UNIVERSAL). > > The zone owner has two KSKs, one of each algorithm and has DS records > for each of the two KSK. The zone is signed with ECDSA. This is allowed > by the multi-algorithm draft. > > However, according to the local policy of the validator, the zone is now > bogus, becase there a PQ1 KSK, but the zone is not signed with PQ1. Yes. That is the example in my document. This would be a surprising outcome to some, which is why my document proposes that it be done with some manner of transparency as an aid to troubleshooting. Since it is also a plausible policy for someone to implement, I think it's a good example. Joe _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
