GitLab

			applications.  See README.libdns. [RT #19369]

			dnssec-* tools.  Major changes:
			- all dnssec-* tools now take a -K option to
			  specify a directory in which key files will be
			  stored
			- DNSSEC can now store metadata indicating when
			  they are scheduled to be published, acttivated,
			  revoked or removed; these values can be set by
			  dnssec-keygen or overwritten by the new
			  dnssec-settime command
			- dnssec-signzone -S (for "smart") option reads key
			  metadata and uses it to determine automatically
			  which keys to publish to the zone, use for
			  signing, revoke, or remove from the zone
			[RT #19816]

			maintenance.  The new "managed-keys" statement can
			be used in place of "trusted-keys" for zones which
			support this protocol.  (Note: this syntax is
			expected to change prior to 9.7.0 final.) [RT #19248]

                        when generating DNSKEYs. [RT #16954]

                        named-checkconf now has -h for help.
                        named-checkzone now has -h for help.
                        Better handling of '-?' for usage summaries.
                        [RT #16707]

                        HMACSHA512 support. [RT #13606]

                        To generate a RSAMD5 key you must explictly request
                        RSAMD5. [RT #13780]

                        DNSKEY, NXT vs NSEC and SIG vs RRSIG.

1658.   [func]          Update dnssec-keygen to default to KEY for HMAC-MD5
                        and DH.  Tighten which options apply to KEY and
                        DNSKEY records.

enable-dnssec -> dnssec-enable

                        from SOA MINIMUM.

1414.   [func]          Support for KSK flag.

                        dnssec-signkey now report their version in the
                        usage message.

                        protocol 3 (DNSSEC), since it's less confusing
			that way.

special case code in dnssec-keygen to parse RSA.

allowed for a zone key.

without crypto support (patch from Olafur)

			arguments.