This is mainly protocol question and as as such it is
better suited for
IETF dnsop working group:
https://datatracker.ietf.org/wg/dnsop/about/
I found a discussion about this very topic which answers my question.
subject: "[DNSOP] CDS/CDNSKEY RRSet authentication"
https://www.ietf.org/mail-archive/web/dnsop/current/msg20683.html
Thank you,
Daniel