DS Concept
The Keyset at the child’s apex contains a “master” key.
This master-key signs the keyset.
strong key, no need to roll-over frequently
The others are zone keys, they can be rolled over. Their integrity is guaranteed by the signature of the strong “master” key.