Why the Internet's Master Key Lives in a Cage

Episode 07  ·  The DNSSEC root key ceremonies  ·  all sources

Four times a year, a small group of people meets inside a guarded building in the United States to use the root key of the internet's address system. This film follows one of those ceremonies and explains what the key does: it signs a short list of keys that lets anyone check that an answer about a web address is genuine.

This is a fully animated film. Every visual was drawn for ColdProvenance; no footage, photographs or recordings are used. Narration is a synthesized voice. The music and sound effects were created for this film. Every factual claim is sourced below. Ceremony dates, counts and measurements are dated; planned ceremonies can move.

Sources

• IANA — Root KSK Ceremonies: the list of past and planned ceremonies (accessed 26 September 2026), with the ceremony pages for 40 and 41 (2020), 53-2 (26 April 2024, Culpeper), 61 and 63 (planned, November 2026)
• PTI / RZ KSK Policy Management Authority — DNSSEC Practice Statement for the Root Zone KSK Operator, 8th edition (14 April 2025): facilities, access tiers, roles, the signing system and its isolation from networks
• IANA — Root DNSSEC KSK Ceremony 62 script and ceremony page (12 August 2026): the seven facility tiers, the ceremony steps, the fingerprint check and the re-bagging of cards
• IANA — Trusted Community Representatives: current and retired Crypto Officers and Recovery Key Share Holders (roles and counts only); TCR travel support; ICANN — Call for Volunteers as Trusted Community Representatives (2017)
• ICANN / IANA — 2024 Hardware Security Module Replacement, Executive Summary (28 February 2024): the end of production of the old signing machines, the non-exportable key, 3 of 7 and 5 of 7
• ICANN — Root Zone KSK Rollover and What to Expect During the Root KSK Rollover (27 July 2026): the 11 October 2026 switch, the three-month signing cycle, what users would see if validation failed
• ICANN — 2018 Root Zone KSK Rollover and Matt Larson, Update on the Root KSK Rollover Project (18 December 2017): the 2017 postponement and the 4% figure
• ICANN Board — The Problem with "The Seven Keys" (13 February 2017)
• Kim Davies (ICANN / PTI) — Inside the Room: Our Upcoming KSK Ceremony (28 April 2026) and Keeping the DNS Reliable: Understanding the KSK Rollover (7 May 2026)
• CERT/CC — Vulnerability Note VU#800113 (8 July 2008): the DNS cache-poisoning flaw, the coordinated fixes and DNSSEC as the full solution
• IANA — Initial Root DNSSEC Design and Launch and launch status updates: the first signed root, 15 July 2010
• IANA / InterNIC — root zone file, serial 2026092502 (downloaded 26 September 2026): our own count of top-level domains and of those with keys vouched for by the root; the signature valid 19 September – 10 October 2026
• Root Server Technical Operations Association — root-servers.org (25 September 2026): 13 root servers, 12 organisations, more than two thousand installations
• APNIC Labs — Use of DNSSEC Validation for World (data to 20 September 2026): share of users behind validating resolvers (an estimate from an ad-based sample)
• Verisign Blog — Duane Wessels, The 2024-2026 Root Zone KSK Rollover: Initial Observations and Early Trends (19 March 2025): the new key published in the root zone in January 2025
• ICANN — Proposal for Future Root Zone KSK Rollovers (1 November 2019)
• James Ball, The Guardian — Meet the seven people who hold the keys to worldwide internet security (28 February 2014): the entry checks and the 2014 lock-in
• João Damas, APNIC Blog — Drilling for the KSK (4 March 2020); Kieren McCarthy, The Register — Internet's safe-keepers forced to postpone crucial DNSSEC root key signing ceremony (13 February 2020)
• IETF — RFC 1034 (1987) and RFC 882 (1983): the design of the Domain Name System

Visuals

• All animation, characters, rooms, maps, diagrams and charts were created by ColdProvenance for this film. No footage, photographs or archival images appear in this film.
• The ceremony room, the cage, the safes and the signing equipment are illustrations based on the ceremony scripts and published descriptions, not plans of the real facilities. The people are illustrative characters, not portraits of any key holder or staff member; Dan Kaminsky is shown as a silhouette.
• The 2014 and 2020 scenes are reconstructions of events described in the sources above.
• The wax seal, the chain of medallions, the help desks and the town-square crowds are analogies. Timelines, dials and the "one in a million" crowd are schematic; their numbers are the sourced figures.
• Coastlines and borders: Natural Earth Public domain, via world-atlas. US state outlines: US Census Bureau cartographic boundary files Public domain, via us-atlas.

Audio

• Narration: synthesized voice.
• Music, ambience and sound effects: created for this film. No stock music, sound libraries or field recordings are used.