See whether a domain is signed, which keys it publishes, and whether the DS record at the registry matches them.