ta_signal_query: document its limitations

diff --git a/modules/ta_signal_query/README.rst b/modules/ta_signal_query/README.rst
index 04ee1edcefe8dafffaffb158d5897275f54f7c72..ad1b345bcaf313abc5b25638c57d5b475717be44 100644 (file)
--- a/modules/ta_signal_query/README.rst
+++ b/modules/ta_signal_query/README.rst
@@ -18,5 +18,12 @@ of new keys. This is of particular interest for the DNS root zone in the event
 of key and/or algorithm rollovers that rely on :rfc:`5011` to automatically
 update a validating DNS resolver’s trust anchor.
 
+.. attention::
+   Experience from root zone KSK rollover in 2018 shows that this mechanism
+   by itself is not sufficient to reliably measure acceptance of the new key.
+   Nevertheless, some DNS researchers found it is useful in combination
+   with other data so we left it enabled for now. This default might change
+   once more information is available.
+
 This module is enabled by default. You may use ``modules.unload('ta_signal_query')``
 in your configuration.