DNSSEC RRSIG expire can have 10% time skew of lifetime (with min 3600s-max 86400s)

[bwbroersma]

Unbound is used with a default signature time skew configuration.
This means the DNSSEC RRSIG expire time can be 10% of it lifetime skewed, with a minimum of 3600s (1 hour) and a maximum of 86400s (24 hours). This fixes at minimum DST issues and at maximum timezone issues.

Depending on the client side DNS resolver, the domain could be unreachable (if Google DNS 8.8.8.8 is used).
Currently no warning is given, see:
https://internet.nl/site/expiredsig3600.go.dnscheck.tools/2911709/ 84%
https://internet.nl/site/expiredsig3601.go.dnscheck.tools/2911710/ 50%

Should this be documented in the DNSSEC explain text?

Should a ℹ️ informational, ⚠️ warning or ❌ failure be shown?

Relevant unbound files/documentation mentioning this:

• /doc/example.conf.in lines 683-687

   	# The signature inception and expiration dates are allowed to be off
   	# by 10% of the signature lifetime (expir-incep) from our local clock.
   	# This leeway is capped with a minimum and a maximum.  In seconds.
   	# val-sig-skew-min: 3600
   	# val-sig-skew-max: 86400
  

• /util/config_file.c lines 268-269

   	cfg->val_sig_skew_min = 3600; /* at least daylight savings trouble */
   	cfg->val_sig_skew_max = 86400; /* at most timezone settings trouble */

• /doc/unbound.conf.5.in lines 1293-1308

   .B val\-sig\-skew\-min: \fI<seconds>
   Minimum number of seconds of clock skew to apply to validated signatures.
   A value of 10% of the signature lifetime (expiration \- inception) is
   used, capped by this setting.  Default is 3600 (1 hour) which allows for
   daylight savings differences.  Lower this value for more strict checking
   of short lived signatures.
   .TP
   .B val\-sig\-skew\-max: \fI<seconds>
   Maximum number of seconds of clock skew to apply to validated signatures.
   A value of 10% of the signature lifetime (expiration \- inception)
   is used, capped by this setting.  Default is 86400 (24 hours) which
   allows for timezone setting problems in stable domains.  Setting both
   min and max very low disables the clock skew allowances.  Setting both
   min and max very high makes the validator check the signature timestamps
   less strictly.
   .TP