that has a complete chain of trust from the root. Since the chain of trust must be traced back to a trusted root without interruption in order to validate, trust anchors must still be configured for secure zones if any of the zones above them are not secure. For example, if the zone "signed.example.org" was secured but the "example.org" zone was not, then, even though the ".org" zone and the root are signed, a trust anchor has to be deployed in order to validate the zone. Political issues surrounding signing the root have been a continuous concern, primarily about some central issues: Other countries are concerned about U.S. control over the Internet, and may reject any centralized keying for this reason. Some governments might try to ban DNSSEC-backed encryption key distribution. Planning In September 2008, ICANN and VeriSign each published implementation proposals and in October, the National Telecommunications and Information Administration (NTIA) asked the public for comments. It is unclear if the comments received affected the design of the final deployment plan. On June 3, 2009, the National Institute of Standards and Technology (NIST) announced plans to sign the root by the end of 2009, in conjunction with ICANN, VeriSign and the NTIA. On October 6, 2009, at the 59th RIPE Conference meeting, ICANN and VeriSign announced the planned deployment timeline for deploying DNSSEC within the root zone. At the meeting it was announced that it would be incrementally deployed to one root name server a month, starting on December 1, 2009, with the final root name server serving a DNSSEC signed zone on July 1, 2010, and the root zone will be signed with a RSA/SHA256 DNSKEY. During the incremental roll-out period the root zone will serve a Deliberately Unvalidatable Root Zone (DURZ) that uses dummy keys, with the final DNSKEY record not being distributed until July 1, 2010. This means the keys that were used to sign the zone use are deliberately unverifiable; the reason for this deployment was to monitor changes in traffic patterns caused by the larger responses to queries requesting DNSSEC resource records. The .org top-level domain has been signed with DNSSEC in June 2010, followed by .com, .net, and .edu later in 2010 and 2011. Country code top-level domains were able to deposit keys starting in May 2010. more than 25% of top-level domains are signed with DNSSEC. Implementation On January 25, 2010, the