code: def _validate(rrset, rrsigset, keys, origin=None, now=None):
      
  
      if isinstance(origin, (str, unicode)):
          origin = dns.name.from_text(origin, dns.name.root)
  
      if isinstance(rrset, tuple):
          rrname = rrset[0]
      else:
          rrname = rrset.name
  
      if isinstance(rrsigset, tuple):
          rrsigname = rrsigset[0]
          rrsigrdataset = rrsigset[1]
      else:
          rrsigname = rrsigset.name
          rrsigrdataset = rrsigset
  
      rrname = rrname.choose_relativity(origin)
      rrsigname = rrname.choose_relativity(origin)
      if rrname != rrsigname:
          raise ValidationFailure, "owner names do not match"
  
      for rrsig in rrsigrdataset:
          try:
              _validate_rrsig(rrset, rrsig, keys, origin, now)
              return
          except ValidationFailure, e:
              pass
      raise ValidationFailure, "no RRSIGs validated"
docs: Validate an RRset
  
      @param rrset: The RRset to validate
      @type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
      tuple
      @param rrsigset: The signature RRset
      @type rrsigset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
      tuple
      @param keys: The key dictionary.
      @type keys: a dictionary keyed by dns.name.Name with node or rdataset values
      @param origin: The origin to use for relative names
      @type origin: dns.name.Name or None
      @param now: The time to use when validating the signatures.  The default
      is the current time.
      @type now: int