Obviously some resolvers are misconfigured and a depressingly large number of production DNS servers around the internet will be running remarkably outdated software that couldn't handle the KSK rollover via the RFC 5011 method properly (though how many of these actually have DNSSEC enabled is an open question). For example, I've heard of resolvers breaking because they mishandled the transition and replaced KSK-2010 with KSK-2017 as soon as they got it.

I saw the postponement late last night, and my immediate but completely untested pet theory is that the reason they're getting so many 'broken' resolvers running such new software (RFC 8145 was published in April 2017, unbound 1.6.4 was released June 27, 2017) is short-lived container instances that only have the old root trust anchor reporting in before they've had a chance to obtain the new KSK - if they even stay up long enough to get it.

From the root-dnssec-announce mailing list, it sounds like more information is due Friday:

"Duane Wessels started the research on this and has done a great job. He's presenting it at DNS-OARC in San Jose on Friday."