Comment by c4mpute

You could use your DNSSEC signing key to sign a validation message (offline, because that doesn't work over DNS).