Is this name signed, and does it check out?
Ask a validating resolver whether a domain's DNSSEC chain checks out. Separates unsigned from broken, which is the distinction that matters.
Enter a domain name.
We ask a validating resolver, once with validation on and once with it off.
The two answers together separate unsigned from broken — which is the distinction that matters.
Why two questions
A resolver that validates refuses a name whose chain is broken; a resolver that does not, answers it. So a domain with a broken chain works for most of the internet and is completely gone for the part that validates — which is why it is usually noticed days late, by someone else.
Asking once with validation and once without separates that case from a name that is simply unsigned. Our own resolvers do not validate yet, so this check is asked of one that does.