options {
   [...]
   nssec-enable yes;
   dnssec-validation yes;
   [...]
};
trusted-keys {
   . 257 3 8 "KEY";
};