code: public static byte []
  digestRRset(RRSIGRecord rrsig, RRset rrset) {
  	DNSOutput out = new DNSOutput();
  	digestSIG(out, rrsig);
  
  	int size = rrset.size();
  	Record [] records = new Record[size];
  
  	Iterator it = rrset.rrs();
  	Name name = rrset.getName();
  	Name wild = null;
  	int sigLabels = rrsig.getLabels() + 1; // Add the root label back.
  	if (name.labels() > sigLabels)
  		wild = name.wild(name.labels() - sigLabels);
  	while (it.hasNext())
  		records[--size] = (Record) it.next();
  	Arrays.sort(records);
  
  	DNSOutput header = new DNSOutput();
  	if (wild != null)
  		wild.toWireCanonical(header);
  	else
  		name.toWireCanonical(header);
  	header.writeU16(rrset.getType());
  	header.writeU16(rrset.getDClass());
  	header.writeU32(rrsig.getOrigTTL());
  	for (int i = 0; i < records.length; i++) {
  		out.writeByteArray(header.toByteArray());
  		int lengthPosition = out.current();
  		out.writeU16(0);
  		out.writeByteArray(records[i].rdataToWireCanonical());
  		int rrlength = out.current() - lengthPosition - 2;
  		out.save();
  		out.jump(lengthPosition);
  		out.writeU16(rrlength);
  		out.restore();
  	}
  	return out.toByteArray();
  }
docs: Creates a byte array containing the concatenation of the fields of the
  SIG record and the RRsets to be signed/verified.  This does not perform
  a cryptographic digest.
  @param rrsig The RRSIG record used to sign/verify the rrset.
  @param rrset The data to be signed/verified.
  @return The data to be cryptographically signed or verified.