options {
…
};
dnssec-policy "kskzsk" {
  keys {
    ksk lifetime unlimited algorithm ecdsa256;
    zsk lifetime P90D algorithm ecdsa256;
  };
};