doc: clarified KSK role and SEP flag

diff --git a/doc/man/keymgr.8in b/doc/man/keymgr.8in
index d9171dacf8298325df526fb767b06cc09cac614e..d1e3b0bbcad7a1eb9d6d3b8a949ea0dfa7a8ac39 100644 (file)
--- a/doc/man/keymgr.8in
+++ b/doc/man/keymgr.8in
@@ -127,10 +127,11 @@ Either an algorithm number (e.g. 14), or text name without dashes (e.g. ECDSAP38
 Key length in bits.
 .TP
 \fBksk\fP
-If set to \fByes\fP, the key will be used as Secure Entry Point.
+If set to \fByes\fP, the key will be used for signing DNSKEY rrset. The generated key will also
+have the Secure Entry Point flag set to 1.
 .TP
 \fBzsk\fP
-If set to \fByes\fP, the key will be used for zone signing. This flag can
+If set to \fByes\fP, the key will be used for signing zone (except DNSKEY rrset). This flag can
 be set concurrently with the \fBksk\fP flag.
 .TP
 \fBcreated\fP

diff --git a/doc/man_keymgr.rst b/doc/man_keymgr.rst
index 891faf3804638558fe5b23c0a90f8552e0a33592..f716fe43741cc7e7d8c2f602f21558fd659252c7 100644 (file)
--- a/doc/man_keymgr.rst
+++ b/doc/man_keymgr.rst
@@ -104,10 +104,11 @@ Arguments are separated by space, each of them is in format 'name=value'.
   Key length in bits.
 
 **ksk**
-  If set to **yes**, the key will be used as Secure Entry Point.
+  If set to **yes**, the key will be used for signing DNSKEY rrset. The generated key will also
+  have the Secure Entry Point flag set to 1.
 
 **zsk**
-  If set to **yes**, the key will be used for zone signing. This flag can
+  If set to **yes**, the key will be used for signing zone (except DNSKEY rrset). This flag can
   be set concurrently with the **ksk** flag.
 
 **created**