Hello, this patch allows dnssec-keyfromlabel and dnssec-keygen to accept -G along with -P or -A, so it is possible to create a key which will be published but not used for signing (yet). -- Petr Spacek @ Red Hat