Okay, so this tremendously complicated and secure ceremony is performed to essentially sign a &quot;Verisign is allowed to do whatever they deem appropriate to the root of DNS in the next six months&quot; certificate.<p>This is really just security theatre, as all the power is delegated to Verisign, and it is almost impossible to detect Zone Signing Key abuse.