gov to visforvaccinated.gov: No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset, resulting in no secure entry point (SEP) into the zone. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (13.107.236.7, 150.171.21.7, 204.14.183.7, 208.84.5.7, 2603:1061:0:700::7, 2620:1ec:8ec:700::7, 2620:1ec:bda:700::7, 2a01:111:4000:700::7, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
gov to visforvaccinated.gov: The DS RRset for the zone included algorithm 13 (ECDSAP256SHA256), but no DS RR matched a DNSKEY with algorithm 13 that signs the zone's DNSKEY RRset. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (13.107.236.7, 150.171.21.7, 204.14.183.7, 208.84.5.7, 2603:1061:0:700::7, 2620:1ec:8ec:700::7, 2620:1ec:bda:700::7, 2a01:111:4000:700::7, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)