The "complication" is simply that systemd-resolved on older, but still supported Ubuntu versions 24.04 LTS and 22.04 LTS does not know about the new KSK. It can be installed on those distros, but systemd-resolved by default only uses keys from its own package, not what is installed system-wide.
The linked online tool https://dnstest.dev/ksk-2024/ shows all green nevertheless. At least with local DNSSEC verification disabled. But with DNSSEC verification the tool cannot even be opened. No idea how this is supposed to work.
Edit: After adding the new KSK manually the online tool displays:
> RFC 8509 support was not detected
All three sentinel names resolved despite the DNSSEC controls passing. Your resolver path does not appear to implement the sentinel, so this test cannot determine whether it trusts KSK-2024.
Easy once you know what to look for :)
https://askubuntu.com/questions/1570248/systemd-dnssec-failu...
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/21705...
The linked online tool https://dnstest.dev/ksk-2024/ shows all green nevertheless. At least with local DNSSEC verification disabled. But with DNSSEC verification the tool cannot even be opened. No idea how this is supposed to work.
Edit: After adding the new KSK manually the online tool displays:
> RFC 8509 support was not detected All three sentinel names resolved despite the DNSSEC controls passing. Your resolver path does not appear to implement the sentinel, so this test cannot determine whether it trusts KSK-2024.