We’re experimenting with incremental DNSSEC signing in dnst signer, to prepare for this functionality in Cascade.
Currently we can sign the changes in the .se zone between last Saturday and Sunday in 3 seconds. Loading the unsigned zone takes 6 seconds and writing out the new signed zone another 12 seconds. More tests coming!
For comparison, the non-incremental signer took ~35 seconds (vs 3s for incremental), even with parallelism.