I've started playing with DNSSEC on my personal domain and I'm using OpenDNSSEC to perform signing and key maintenance; I only have a static zone, so OpenDNSSEC is an easy fit.
Just to toy with things, I decided to do a manual key rollover for my KSK and ZSK. The time it's going to take for the ZSK to transition from retired to dead is two weeks. That's a massive amount of time, and seems completely unnecessary, given that most TTLs are less than 48 hours and propagation delays are no more than 24 hours.
I've been reading the document "Good Practices Guide for Deploying DNSSEC", where they recommend this two week delay, but don't seem to give an justification for the delay.
From the paper:
The duration of the transition from one state to the next is a function of the lifetime of the records in a zone, the time required to deliver the zones to the external servers and clock jitter time (Internet - Draft, DNSSEC Key Timing Considerations ) .
The recommended period during which a KSK is retired before it is removed from the zone ( retirement time ) is four weeks. For the ZSK , the recommended introduction time is four days and the retirement time is two weeks.