https://labs.ripe.net/author/gih/re-counting-dnssec/