code: public static void
  verify(RRset rrset, RRSIGRecord rrsig, DNSKEYRecord key) throws DNSSECException
  {
  	if (!matches(rrsig, key))
  		throw new KeyMismatchException(key, rrsig);
  
  	Date now = new Date();
  	if (now.compareTo(rrsig.getExpire()) > 0)
  		throw new SignatureExpiredException(rrsig.getExpire(), now);
  	if (now.compareTo(rrsig.getTimeSigned()) < 0)
  		throw new SignatureNotYetValidException(rrsig.getTimeSigned(),
  							now);
  
  	verify(key.getPublicKey(), rrsig.getAlgorithm(),
  	       digestRRset(rrsig, rrset), rrsig.getSignature());
  }
docs: Verify a DNSSEC signature.
  @param rrset The data to be verified.
  @param rrsig The RRSIG record containing the signature.
  @param key The DNSKEY record to verify the signature with.
  @throws UnsupportedAlgorithmException The algorithm is unknown
  @throws MalformedKeyException The key is malformed
  @throws KeyMismatchException The key and signature do not match
  @throws SignatureExpiredException The signature has expired
  @throws SignatureNotYetValidException The signature is not yet valid
  @throws SignatureVerificationException The signature does not verify.
  @throws DNSSECException Some other error occurred.