Dear Guru(s),


If the following questions have already been asked, I do apologize and would very much appreciate the pointers to where I can read the answer(s).

I am currently ‘running’ a DNSsec-signed zone using Alg-8 [RSA/SHA2-256].

However, I would very much like to DNSsec-sign and publish my zone with two different algorithms (say, Alg-8 [RSA/SHA2-256] + Alg-13 [ECDSA-P256/SHA2-256]) *simultaneously*,
in case the client-validators out there cannot process one algorithm or the other (never mind that they both are the ‘MUST’ in RFC 8624).

It also is an opportunity to train myself in case I need to ‘add’ the third one (say, Alg-15 [ED25519]) or ‘migrate’ to the Alg-13 + Alg-15 combination in the future.

Background Information:
1. I have a ‘hidden server’ acting as ‘The Signer’.
2. ‘The Signer’ feeds the already-signed zone to the visible ‘Primary Server’.
3. The ‘Primary Server’, in turn, feeds all other ‘Secondary Servers’, some of which are not under my control.