They do validate signed zones -- that is true. How do they run their own zones?

  $ dig +short letsencrypt.org DS
  $