Merge branch 'dnssec'

The DNSSEC notes in CHANGELOG.md belong under Unreleased; git had put
them into the 0.1.0 section, which didn't exist when the branch was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -150,7 +150,7 @@ to stderr with `-o json` or `-o yaml`, so stdout holds just the documents.
 |------|---------|
 | 0 | Success |
 | 1 | Other error (bad arguments, connection failure, ...) |
-| 2 | A check found problems (`zone serials`, `zone delegation`); its report was printed |
+| 2 | A check found problems (`zone serials`, `zone delegation`, `zone dnssec check-ds`, `zone registrar status`), or a step can't be taken yet (`zone dnssec disable` before turning off has finished); the report was printed |
 | 3 | Not authenticated, or not allowed (token lacks the permission) |
 | 4 | Not found |
 | 5 | Conflict: concurrent change, object in use, drift |
@@ -211,6 +211,37 @@ zone's delegation and glue against the zone, and calls a zone that isn't
 delegated (an internal-only zone) a note, not a problem. Both only run when
 you run them; see [operations.md](operations.md#checking-name-servers-and-the-delegation).
 
+### DNSSEC and the registrar
+
+```sh
+jarl zone dnssec status adbraun.lol --view external     # keys, DS record, what's next
+jarl zone dnssec enable adbraun.lol --view external [--policy NAME]
+jarl zone dnssec check-ds adbraun.lol --view external   # has the parent got the DS? tells named
+jarl zone dnssec disable adbraun.lol --view external    # step 1: insecure; run again to finish
+jarl zone dnssec wipe adbraun.lol --view external [--force]   # off at once, keys deleted
+
+jarl zone registrar status adbraun.lol --view external  # Porkbun: NS, glue, DS vs the zone
+jarl zone registrar sync-glue adbraun.lol --view external [--dry-run]
+jarl zone registrar set-ns adbraun.lol --view external [NS...] [--dry-run]
+jarl zone registrar publish-ds adbraun.lol --view external [--key TAG]
+jarl zone registrar remove-ds adbraun.lol 51126 --view external
+```
+
+[dnssec.md](dnssec.md) explains the steps. `enable` is safe at any time:
+validation only starts once the zone's DS record is at the parent, and
+`status` says when to publish it. `disable` never makes a zone unsigned
+while the parent may still have its DS: its first run switches to BIND's
+insecure policy, and it finishes (exit 0) only when named is done (exit 2
+before). `wipe` switches off at once and deletes the keys, and refuses
+while the parent zone has a DS record for the zone; `--force` wipes when the
+parent can't be checked.
+
+The `registrar` commands need a Porkbun API key in jarl.yaml and an
+administrator. Each change checks first that it won't break the domain and
+is refused otherwise: `--dry-run` shows the checks, `--force` skips them.
+(Here `--force` means that; elsewhere it overwrites files changed outside
+Jarl.)
+
 ## Records
 
 ```sh