Tooling and serialization format for DNSSEC signture chain

Question

I'm looking for a compact, canonical (and possibly but not necessarily human-readable) format for serializing the signature chain for a RRset (or proof that it lies under an insecure delegation) for permanent recording and offline checking, and having trouble finding anything. All of the tool I've used (dig, delv, online tools like dnsviz, etc.) are capable of performing the validation but not producing as output a proof that can be stored and re-checked. Is there existing FOSS tooling to do this?