{
  "context": "Evaluates how well the solution uses dnspython's DNSSEC utilities to build DNSKEY/DS material, sign an authoritative A RRset, and validate the resulting RRSIG. Emphasis is on correct dnspython APIs (dns.dnssec, dns.name, dns.rrset) rather than general crypto plumbing.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "DNSKEY build",
      "description": "Constructs DNSKEY rdata/rrset with flag 257 and protocol 3 using dnspython types (e.g., dns.rdtypes.ANY.DNSKEY.DNSKEY or dns.dnssec.make_dnskey) and the provided owner name.",
      "max_score": 15
    },
    {
      "name": "Key tag",
      "description": "Derives the key tag directly from the DNSKEY using dns.dnssec.key_id (or equivalent dnspython helper) instead of manual math or hard-coding.",
      "max_score": 10
    },
    {
      "name": "DS digests",
      "description": "Generates DS records with digest types 2 and 4 via dns.dnssec.make_ds against the produced DNSKEY, returning digests that match canonical output and preserving caller-provided order.",
      "max_score": 20
    },
    {
      "name": "RRset setup",
      "description": "Builds the A RRset for signing using dns.name.from_text and dns.rrset.from_text (or rdataset helpers) so record ordering and TTL align with DNSSEC canonicalization requirements.",
      "max_score": 10
    },
    {
      "name": "Signing",
      "description": "Creates the RRSIG via dnspython signing helpers (e.g., dns.dnssec.sign) using the supplied inception/expiration times and returns presentation-form RRSIG text from the resulting rdata.",
      "max_score": 20
    },
    {
      "name": "RRSIG fields",
      "description": "Ensures the RRSIG encodes the correct type covered (A), labels for signed.example., original TTL 300, algorithm RSASHA256, and the matching key tag by relying on dnspython-generated values rather than manual string assembly.",
      "max_score": 10
    },
    {
      "name": "Validation",
      "description": "Verifies signatures with dnspython's validation API (dns.dnssec.validate or dns.dnssec.validate_rrsig) using a key mapping that includes the generated DNSKEY, rejects tampered signatures/DNSKEY, and enforces the validity window with an explicit now parameter when needed.",
      "max_score": 15
    }
  ]
}