Mention in the DNSSEC guide in the "revert to unsigned" recipe that you can publish CDS and CDNSKEY DELETE records to remove the corresponding DS records from the parent zone. (cherry picked from commit f088657eb1)
f088657eb1