Describe ZSK+KSK here.

RFC 4035

2.1. Including DNSKEY RRs in a Zone

To sign a zone, the zone's administrator generates one or more
   public/private key pairs and uses the private key(s) to sign
   authoritative RRsets in the zone.