Bottom-up DNSSEC validation
3

Start with RRSET

Chase signatures up to known and trusted key