code: public void apply(Message m, byte [] old)
  throws IOException, SignatureException, InvalidKeyException,
         NoSuchAlgorithmException
  {
  	
  	int validity = Options.intValue("sig0validity");
  	if (validity < 0)
  		validity = VALIDITY;
  
  	long now = System.currentTimeMillis();
  	Date timeSigned = new Date(now);
  	Date timeExpires = new Date(now + validity * 1000);
  	
  	String algorithmName;
  	if (algorithm == DNSSEC.DSA) {
  		algorithmName = "SHA1withDSA";
  	} else if (algorithm == DNSSEC.RSAMD5) {
  		algorithmName = "MD5withRSA";
  	} else if (algorithm == DNSSEC.RSASHA1) {
  		algorithmName = "SHA1withRSA";
  	} else {
  		throw new NoSuchAlgorithmException("Unknown algorithm");
  	}
  
  	SIGRecord tmpsig = new SIGRecord(Name.root, DClass.ANY, 0, 0,
  					 algorithm, 0, timeExpires, timeSigned,
  					 footprint, name, null);
  	
  	byte [] outBytes = DNSSEC.digestMessage(tmpsig, m, old);
  	
  	Signature signer = Signature.getInstance(algorithmName);
  	signer.initSign(privateKey);
  	signer.update(outBytes);
  	byte [] signature = signer.sign();
  
  	/*
  	 * RSA signatures are already in correct format, but Java DSA
  	 * routines use ASN.1; convert this to SIG format.
  	 */
  	if (algorithm == DNSSEC.DSA) {
  		DSAKey dsakey = (DSAKey) privateKey;
  		signature = DSASignature.toDNS(dsakey.getParams(), signature);
  	}
  	
  	SIGRecord sig = new SIGRecord(Name.root, DClass.ANY, 0, 0, algorithm,
  				      0, timeExpires, timeSigned, footprint,
  				      name, signature);
  	m.addRecord(sig, Section.ADDITIONAL);
  }
docs: Appends a SIG(0) signature to the message.
  @param m the message
  @param old if this message is a response, the original message