as of late, many DNSSEC hosts no longer provide the second RRSIG record as well as the DNSKEY record. This snippet requires both.