> On 20 Aug 2021, at 4:59 pm, Michael Grimm <[email protected]> wrote:
>
> Thanks for that information I didn't think about before.
>
> All of my domains are signed by KSK(13) and ZSK(13) and I do still rotate my
> ZSK's every 90 days after my migration from DSA keys. If I do understand you
> correctly, I could modify my ZSK rotation scheme to once a year given the
> case that key disclosure is not an issue, correct?
Yes, provided you're still confident that the process works
correctly and reliably. Sometimes it is a good idea to practice
things more frequently, just be sure you're doing it right...
--
Viktor.
