administrator
Click on the red underlined text to get to the source
...
To sign a zone, the zone's administrator generates one or more
public/private key pairs and uses the private key ...
... be used to verify RRSIGs.
If the zone administrator intends a signed zone to be usable other
than as an island of security, the zone apex MUST contain at least
...