No signature needed. Just hand out whatever you like for the entire zone.

    There are several exceptions to the above example.

    First, if "example.com" does not support DNSSEC, there will be no RRSIG record
    in the answer and there will not be a DS record for "example.com" in the "com"
    zone. If there is a DS record for "example.com", but no RRSIG record in the
    reply, something is wrong and maybe a man in the middle attack is going on,
    stripping the DNSSEC information and modifying the A records. Or, it could be a
    broken security-oblivious name server along the way that stripped the DO flag
    bit from the query or the RRSIG record from the answer. Or, it could be a
    configuration error.

http://en.wikipedia.org/wiki/Domain_Name_System_Security_Ext...