@techreport{fanf-dnsop-trust-anchor-witnesses-00,
    number =    {draft-fanf-dnsop-trust-anchor-witnesses-00},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-fanf-dnsop-trust-anchor-witnesses/00/},
    author =    {Tony Finch},
    title =     {{The WS resource record: dispersing trust in the DNSSEC root keys}},
    pagetotal = 11,
    year =      2014,
    month =     feb,
    day =       13,
    abstract =  {At the moment the root DNSSEC key is a single point of trust and a single point of failure for the whole system. This memo describes a mechanism for dispersing trust in the root key. Witnesses vouch for the root trust anchor by publishing WS records in the DNS. Validators only update their root trust anchors if multiple witnesses agree. The root-witnesses.arpa zone enables a validator to bootstrap trust when it has no working trust anchors other than its witnesses.},
}