Wes Hardaker and I have a proto-draft called "Ball and Chain" - it basically provides a chain of KSKs from the current, to the next, to the next, to...
A resolver which has been sitting for many years can enter at whatever KSK it knows about, and walk its way up the chain (never down) until it reaches the current one. The keys can be annotated to provide info like "this was a normal rollover, keep going" or "this rollover occured because of compromise, abort, and revoke if you have already seen it". This is not perfect - a resolver which was sleeping, and *first* awakes behind a malicious attacker who has a copy of the private key from a compromised KSK could be lead astray -- but, this is one of those "you need to discuss the threat model" cases. Obviously, this can and should be used in conjunction with things like TLS checks, etc.
I cannot remember if we actually published the draft, or were sufficiently despondent after the last few meetings that we didn't bother....
I can find it if people are interested....