before marking it as insecure. One set of conditions that can trigger this occurs naturally when rolling DNSKEY algorithms. [RT #22309]