Top-down DNSSEC validation
5

Resolving www.nlnetlabs.nl yields chain:
. -> .nl. -> .nlnetlabs.nl -> www.nlnetlabs.nl

Validation:
DS for root server given
root contains DS for .nl.
.nl. contains DS for .nlnetlabs.nl.
etc.

Until you reach the requested resource record(s)