Include DS records explicitly; check them when diffing.
[zones] / certs /
drwxr-xr-x   ..
-rw-r--r-- 6340 distorted-ca.cert
-rw-r--r-- 7345 http-server-www#1.cert