DNSSEC validation is broken because ASUSWRT still includes only the old root KSK-2017 trust anchor (key tag 20326) in /sbin/rc and is missing KSK-2024 (key tag 38696). Since the root KSK rollover on 11 Oct 2026, valid domains return SERVFAIL when DNS...
