Add some doc for DNSSEC key rollover