Assuming I am administering a DNS zone and I operate an authoritative name server that is secured with DNSSEC (split ZSK/KSK setup).
When the Zone-Signing-Key (ZSK) ever gets compromised, would it be enough to resign the zone with a newly generated ZSK or would the KSK also needed to be exchanged (and the according DS record inserted into the parent zone) as well?
My concern is that a man-in-the-middle could use the compromised ZSK to generate fake records without a resolver being able to detect this, if he simultaneously publishes the old ZSK instead of the new one. I am neither aware of a revoking mechanism for Zone-Signing-Keys nor does it seem possible to also sign a "ZSK key inactive date" with the KSK.
Am I missing something or would the compromisation of the ZSK therefore require an exchange of the KSK, too? Also, what are the main advantages of a split ZSK/KSK setup in this case?