Comment by thayne

> Using a CSK with unlimited lifetime

Well in cases where I have had to deal with DNSSEC, I've had to rotate the KSK annually for compliance reasons.