I want to establish trust in a DNSSEC record. I found, that it can be done
$ dig +sigchase +trusted-key=./root.key @188.8.131.52 eesti.ee
root.key could be obtained with
$ dig . DNSKEY @184.108.40.206 | grep -Ev '^($|;)' > root.keys
however, this would be insecure and suspectible to mitm attacks.
I believe that IANA publishes the root key on https://www.iana.org/dnssec/files (where it is signed with HTTPS, PGP, etc.), but it is in XML format and I failed to use it with dig.
How to convert it from XML to same format as root.keys ?