Not mentioned in the post, I figured out some things with PowerDNS. Turns out, I can use Dolo to generate the KSK/ZSK keys and import those into PowerDNS to sign my zones automatically. What's Dolo? An app I had to make a few months ago to get some other things working. https://dolo.neuenet.com By the end of this development, I'm gonna have a suite of neat open-source tools for DNS. Such an old and stodgy protocol that we all depend on but NOBODY likes working with.