add another step in the dnssec stuff

howto/dns.md

@@ -120,6 +120,14 @@ With the above, you would have the following in Joker:
 
 And click "save".
 
+Make sure to update the record in the `tor-puppet.git` repository, in:
+
+    modules/unbound/files/torproject.org.key
+
+Copy the latest `dsset` entry in there. Normally, unbound takes care
+of updating that file to chase new versions, but new hosts will need
+that new anchor for bootstrapping.
+
 After a little while, you should be able to check if the new DS record
 works on [DNSviz.net](http://dnsviz.net/), for example, the [DNSviz.net view of
 torproject.net](http://dnsviz.net/d/torproject.net/dnssec/) should be sane.