Short version: If a DNSSec-signed sone suddenly replace both ZSK (and all records related to the old ZSK), and at the same time keep the KSKs (which are referenced to by upstream server). Will it cause any trouble? And will it cause trouble after the TTL of the zone/records expire?
Long version: So I am replacing a 2012R2 Authorative DNS-server (File-backed) which host a handful of DNSSEC zones.
From what I have gathered, it is not possible to migrate the ZSKs for a zone, but it is possible to migrate the KSKs. (Technically I can migrate both, but can only import the KSKs on the zone for some reason). It is also not possible to add any 'custom' DNSSEC-related records when Windows Server flags the zone as signed. The upstream DNS-server (country level TLD) only contains references to the KSKs.
If I understand this correctly, If I copy the zone, generate new ZSKs and sign it. Then put it online (will have same IP as previous server). This should only lead to problems with signature verification during the TTL of the zone/records in question (I believe), and then only if someone has cached just the record and not the signature-record? (I am also aware that some DNS-servers might cache for more than the Zone TTL).