Here is the answer I got for .com.my. DNSKEY
:
com.my. 3600 IN DNSKEY 257 3 8 BQEAAAABu3FxmZrMlOMXlk2I2LeTsoMre8QaJKw75gSH9G8VCNX6AaVo8hT8qQyfNWDtdM+xiGqmYhWYFlABsIurfdfXVHNFep4Odn0klVD9tz11l9J4csNRRnJwOMYZV2q6yiBbyJuTvx6Z0xWuTsxtELIA597gxuGNQPumkIvllrTzauwhBtZp+m/GZwehVNAa1Vc6VxCLCPkXVK/6PliezJOTcJJXJmBTrML5x7UrYEYTW0EKDQCW4wHWbDrIXTuIXeBNW2S9ITX97WpLJXU5hSJPRteV8NK/j5KEbHxeq852cbU7CWa6whBz+sR/BoPuzTkX4M1e1PBJs7eppNNYffnsvw==
com.my. 3600 IN DNSKEY 257 3 8 BQEAAAAB51ZYIFm8oIy4aaNzWPC0UmEuG7D/QB7fETcAf7bIYqVUpKnmgFPqmMwOSSSvbpJfJR9SvF/N5Gbaao3bI+GGVYRMo2nQ7djcAGkzrv0f1ZOHO1sdV0XQrjNTj+BpI1tTqQRun+78WxIU+Km8gRRaZE9NM9riELyhu7pAJiFEAs7Y1CjiFp00+Q5w6Xc2YOhiFy9h957Kq9YRhc1ELlJ8m276ekcda0bdJ2FF5iad8BbcC6+Iep7Mhc9TP7u4cI39j8TJRW0V9nTo/dc7Z1eIDQYxZ0hvkk1AY/f2SOT1/72M35yBQZLAAsStfX/w0F+Sg8ndoIcRBCvhajbckjFQQQ==
com.my. 3600 IN DNSKEY 256 3 8 AwEAAcYcelsQmHJIShuGUB7QZQRx3jq253RbvLr8b2Piwmo6M9jvQBbNgMHkOiFI+v+AczufDzcf9lia38rAK5fmZqxHsft9meoFB1uXE9pp/ZB27rP+PTs9gGvuZKB/HyKjcwiwYWEhYQMrRaXk0Pr081MGzBjamZTMvvKTyRcmA+G9
com.my. 3600 IN RRSIG DNSKEY 8 2 3600 20200628013603 20200529003005 14256 com.my. MfavTkDT/Ar+31EN5BpCOt8ehR6QW8z/UaAZOLonvxEc3d8Xgx72dt09kyZworhXjg9FyUWtEJTWkrXcuIrMtrNcKg6smdnVzX04xbrDWDfKLYJh+0IxvtxPJeOQZ/ii0DpGn7oCPYqwc7qo3hZYPbgijiFsSVP+QJSepLCAnqjGfmYlmwltRgmlc9LCtCfbsO3ySlOVkhHtACa9BEYMG66rT8fAszFw48j8b3N7RdV/mRFYt/FHPgFpP2p4m6jNxWXDr1EQzuzLfswvUEs8Zl6swRHbutvm5j58mlJ+oM47x4qIpxLskeIfTwI33Bqv21HuRh3IwpG8tZNZbAxqcQ==
com.my. 3600 IN RRSIG DNSKEY 8 2 3600 20200628013603 20200529003005 52884 com.my. DaN+2IviGp8h7mGkWEpvCgOSsPZW0O9TORE6k/cfK9kbOg3ckjRtm1vAJ4VeXV/vOJzvjRkm2g9T31dhOTI9XgF4ro/0rvrZ9uwifaPWbKle/Q5mgfreCinEE13KGa2VIDacbRSFwtEeheCwGcvXivDDhkW7uQ4/a8Agxy0vS1VYduF9gY7WJhivZbko1ERwYdpqJCrb6Ppo9NFTWl5gZtHFc+WbF+pYkegGq6uPfcjGhi5C46d1gyjGy4NDOLP9hLDaConKWgayDIEzzHcvUR7rk4fCLfTfGimvFR8MBBcExKyc0xsz8YtEk/lo2Y3l+4gCJeJ/FOuJbzjjUVr8gg==
I do not get how to validate the RRSIG. For both RRSIG, I find one key with the same KeyTag/Algo/SignerName, but for both RRSIG the verification fails.
I do not get why it returns two RRSIG and two KSK. When I try nst.com.my
on https://dnsviz.net that works well (https://dnsviz.net/d/nst.com.my/dnssec/), so how do they validate those records?