Allow including other DNS records

[NotActuallyTerry]

Similar to SPF's include mechanism, AKD/S should allow a user to include other DNS records with something like i:_akds.cocytus.services i:_akds.tem.party
If an AKD/S client requires GPG signature verification, they should not follow any include statements.

[thomotron]

This sounds good to me.

On the GPG verification, could an AKD/S record with an include then recursively require all included records are also signed by the same key?

[NotActuallyTerry]

That would make sense. It may also make sense to have allow specifying multiple GPG keys to check against. If you're including another key, it'd make sense that you trust the key author

[thomotron]

True, then that would enable trusted delegation without too many extra steps.

In case any lookups fail to resolve or aren't valid, I'm thinking that the standard be that they're ignored so that it doesn't lead to DoS attacks or complete failure if a record is malformed for instance