Hello.

I've found this warning in my journal:

... kresd[1071788]: [taupd ] you need to update package with trust anchors in "/usr/share/dns/root.key" before it breaks

I don't know how to do that.

I think my system is current but just ran: apt update; apt list --upgradable and it shows nothing regarding knot.

First of all, ICANN is super-careful, so there's no need to panic (yet).  I read that they don't plan to sign with the new key before October 2026:
https://lists.icann.org/hyperkitty/list/root-dnssec-announce@icann.org/message/YRBAIAU5YI3FGGUY3YKNM4HLVCVLFXMA/

As I see you mentioning `apt`, I think this update is exactly what is needed
https://tracker.debian.org/news/1603458/accepted-dns-root-data-2024071801deb12u1-source-into-proposed-updates/
and incarnations of that in various versions of Debian, Ubuntu and other derivatives.  I really hope that a well-maintained distro couldn't miss to update this.

--Vladimir