Your zone is DNSSEC signed, but you are missing one key piece, the DS record to validate that
the key with tag 2371, algorithm 13 is a valid key.
If you need help, ping me.
https://dnsviz.net/d/nab.sunnyvalley.cloud/dnssec/
@lrosenman, thanks for the heads-up! Looking into it.
Anything I can do to help here @mb?