What you suggest would be rather silly, wouldn't it? It would mean that you would have to disable DNSSEC every time you make any modification to your zone, which would both be very laborious and leave your zone unprotected for a long time (for the TTL on the parent zone).
When you enable DNSSEC, the parent zone adds
DS records authorizing your
DNSKEY to sign the records in your zone. When you change a RRset you simply sign it again with your key, resulting in a new
RRSIG records have Signature Validity Periods (RFC 6781, 4.4.2); you must resign the RRset before it expires. It's better automate this! Also, until the validity period expires, it would be possible to use the old
RRSIG to sign an old RRset and perform a replay attack. It's all explained in detail in the RFC.