The DNS root is signed with a 1024 bit key, currently:<p><pre><code>    -----BEGIN RSA PUBLIC KEY-----
    MIGJAoGBALgVvZmZibtBpha3AIykU0OY4gcCXTcskYJUxGsdmV&#x2F;awfmKcHlSrjNM
    ioSgy4sByj+HpcbsyrZVGPp+JBXzYwwuEF&#x2F;6w1k7vKYTK6vMSqgVcgooNkfb5MaR
    F2y7MEpPxfStnfwu8knE24ExB0hYE1URxJ9CqB3zMSl&#x2F;vicXYXXlAgMBAAE=
    -----END RSA PUBLIC KEY-----
</code></pre>
That key - the zone signing key - is signed with the key signing key, which <i>is</i> 2048 bits.