KSK
Key Signing Key: the long-lived DNSSEC key that signs the DNSKEY set and whose hash is published as a DS record in the parent zone.
A KSK (Key Signing Key) is the DNSSEC key whose only job is to sign the DNSKEY record set in its zone. Because the KSK's public hash is published in the parent zone as a DS record (and any change must be coordinated with the parent), KSKs are deliberately long-lived, often 1 to 2 years between rollovers. The shorter-lived ZSK does the bulk of the signing work. Splitting the roles means the operator can rotate ZSKs frequently without touching the parent zone, while the KSK rollover (an inherently slower, more coordinated process) happens rarely.