DNSSEC diagram