when boostrapping root TA, the DNSKEYs are updated immediately after retrieving DS from the side channel