If any of the zone's KSKs have changed since the last time this file was sent to the parent, then they keyset must also be transferred to the parent. If none of the zone's KSKs have changed, this step may be skipped.

Secure communication between the parent and child zone is done out-of-band.