code: public static RRSIGRecord
  sign(RRset rrset, DNSKEYRecord key, PrivateKey privkey,
       Date inception, Date expiration, String provider) throws DNSSECException
  {
  	int alg = key.getAlgorithm();
  	checkAlgorithm(privkey, alg);
  
  	RRSIGRecord rrsig = new RRSIGRecord(rrset.getName(), rrset.getDClass(),
  					    rrset.getTTL(), rrset.getType(),
  					    alg, rrset.getTTL(),
  					    expiration, inception,
  					    key.getFootprint(),
  					    key.getName(), null);
  
  	rrsig.setSignature(sign(privkey, key.getPublicKey(), alg,
  				digestRRset(rrsig, rrset), provider));
  	return rrsig;
  }
docs: Generate a DNSSEC signature.  key and privateKey must refer to the
  same underlying cryptographic key.
  @param rrset The data to be signed
  @param key The DNSKEY record to use as part of signing
  @param privkey The PrivateKey to use when signing
  @param inception The time at which the signatures should become valid
  @param expiration The time at which the signatures should expire
  @param provider The name of the JCA provider.  If non-null, it will be
  passed to JCA getInstance() methods.
  @throws UnsupportedAlgorithmException The algorithm is unknown
  @throws MalformedKeyException The key is malformed
  @throws DNSSECException Some other error occurred.
  @return The generated signature