dns - Does it matter which BIND9.11 master signs a zone, so long as the KSK and ZSK are identical on both?

Question

Preface: BIND 9.11, DNSSEC, Multi-master/primary (identical), multi-tiered-slaves/secondaries (identical pairs, tiered pairs), manual zone edits

Does any data difference in the ".signed" zone really matter if a zone is signed with the same (privately) shared ZSK and KSK pair?

In example: If masterA and masterB simultaneously signed "mycoolzone.com", then passed this down to their respective tiered slave/secondary pairings...does it really matter?

I am exploring implementing DNSSEC and wanted to see if the actual signing DNS master really matters. Despite the data in the .signed zone output from dnssec-signzone being different between the masters (as each signed and produced their *.signed copy), I am not actually seeing any errors/issues so far. The reason for the ask is that allowing both masters to sign the zone without worrying about having to sign completely elsewhere and then rsync is a significant simplification in a proposed workflow.

question from:https://stackoverflow.com/questions/65948316/does-it-matter-which-bind9-11-master-signs-a-zone-so-long-as-the-ksk-and-zsk-ar

Answer 1

Waitting for answers