[ksk-change] How to tell which trust anchors are present at a DNS resolver.