DNS
Query DNSSEC keys (ZSK/KSK) and algorithm.
DNSSEC signs the zone. DNSKEY holds KSK (257) and ZSK (256). The parent DS record binds those keys.
No record means DNSSEC is off, which is common and valid. On without DS means a broken chain.
The algorithm number (e.g. 13 ECDSA P-256, 8 RSA/SHA-256) is the signature type. Without a parent DS, signatures cannot be validated and browsers may fail the name.
No. But if it is on and DS/DNSKEY disagree, the name can fail completely.
KSK (flag 257) binds to DS; ZSK (256) signs zone records. Rollovers are planned separately.
DNSKEY plus parent DS means the chain is built. DNSKEY alone is not enough.
Remove DS at the registrar first, then DNSKEY. The reverse order can take the name down briefly.
ECDSA P-256 (13) or ED25519 (15) are modern and compact. RSA 2048 is still common.