static void
verifyMessage(Message message, byte [] bytes, SIGRecord sig, SIGRecord previous,
	      KEYRecord key) throws DNSSECException
{
	if (message.sig0start == 0)
		throw new NoSignatureException();

	if (!matches(sig, key))
		throw new KeyMismatchException(key, sig);

	Date now = new Date();

	if (now.compareTo(sig.getExpire()) > 0)
		throw new SignatureExpiredException(sig.getExpire(), now);
	if (now.compareTo(sig.getTimeSigned()) < 0)
		throw new SignatureNotYetValidException(sig.getTimeSigned(),
							now);

	DNSOutput out = new DNSOutput();
	digestSIG(out, sig);
	if (previous != null)
		out.writeByteArray(previous.getSignature());

	Header header = (Header) message.getHeader().clone();
	header.decCount(Section.ADDITIONAL);
	out.writeByteArray(header.toWire());

	out.writeByteArray(bytes, Header.LENGTH,
			   message.sig0start - Header.LENGTH);

	verify(key.getPublicKey(), sig.getAlgorithm(),
	       out.toByteArray(), sig.getSignature());
}
Generate a DNSSEC signature.  key and privateKey must refer to the
same underlying cryptographic key.
@param rrset The data to be signed
@param key The DNSKEY record to use as part of signing
@param privkey The PrivateKey to use when signing
@param inception The time at which the signatures should become valid
@param expiration The time at which the signatures should expire
@param provider The name of the JCA provider.  If non-null, it will be
passed to JCA getInstance() methods.
@throws UnsupportedAlgorithmException The algorithm is unknown
@throws MalformedKeyException The key is malformed
@throws DNSSECException Some other error occurred.
@return The generated signature
src/main/java/core/org/xbill/DNS/DNSSEC.java