Is the public DNSKEY of the DNS root zone that I have to trust when validating a DNSSEC key chain usually bundled with an OS? If so where is it located under Ubuntu 15.04, Linux?
What is otherwise the method to obtain it, that is considered "safe"?
I am using
dig +nocomments +nostats +nocmd +noquestion -t dnskey . > trusted-key.key at the moment but I'd be interested in what the theoretically preferred solution of obtaining it would be.