ルートゾーンKSK/ICANN/verisignについて、ここに記述してください。

Duane Wessels
https://blog.verisign.com/domain-names/root-zone-ksk-rollover-postponed/

One missing piece, however, was a way to tell 
whether or not a population of DNSSEC validating resolvers had successfully updated their trust anchors.


These validators appear to still have only the old KSK and are not accepting the new KSK into their trust anchor set. These represent six to eight percent of the population providing data, a figure we first shared with ICANN in late August.