A DNSSEC-signed public zone validates while the internal split-horizon copy still serves unsigned child records during a failover rehearsal

External trust is healthy and internal trust assumptions no longer match it. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.