domain name system - Pushing DNSSEC updates with offline keys

In a non-professional capacity, I look after the DNS of
some 18 domains: mostly personal/vanity domains for immediate family. The whole shebang
is outsourced to an inexpensive managed hosting provider who have a web interface
through which I manage the zones.

These domains
are so unimportant that an attack targeted at them seems much less likely than a general
compromise of my provider's systems, at which point the records of all their customers
might be changed to misdirect traffic (perhaps with extremely long TTLs). DNSSEC could
mitigate such an attack, but only if the zones' private keys are not held by the hosting
provider.

So, I wonder:
how can one keep DNSSEC private keys offline yet still transfer signed
zones to an outsourced DNS
host?

The most obvious answer (to
me, at least) is to run one's own shadow/hidden master (from which the provider can
slave) and then copy offline-signed zonefiles to the master as
required.

The problem is that the only machine I
(want to^*) control is my personal laptop, which usually connects
from a typical home ADSL (i.e. behind NAT over a dynamically-assigned IP address).
Having them slave from that (e.g. with a very long Expiry time
on the zone for periods when my laptop is offline/unavailable) would not only require a
dynamic DNS record from which they can slave (if indeed they can slave from a named host
rather than an explicit IP address), but would also involve me running a DNS server on
my laptop and opening both it and my home network up to the incoming zone transfer
requests: not ideal.

I would
prefer a much more push-oriented design, whereby my laptop
initiates transfer of offline-signed zonefiles/updates to the
provider.

I looked into whether
nsupdate could fit the bill: documentation is a little sketchy,
but my testing (with BIND 9.7) suggests it can indeed update DNSSEC zones, but only
where the server holds the keys to perform the zone signing; I have not found a way to
have it take an update including the relevant RRSIG/NSEC/etc. records and have the
server accept them. Is this a supported
use-case?

If not, I suspect the only
solutions which could fit the bill will involve non-DNS-based transfer of the zone
updates and would welcome recommendations that are supported by (hopefully inexpensive)
hosting providers: SFTP/SCP? rsync? RDBMS replication? Proprietary
API?

Finally, what would be the practical
implications of such a setup? Key rotation is jumping out at me as being an obvious
difficulty, especially if my laptop is offline for extended periods. But the zones are
extremely stable, so perhaps I could get away with long-lived
ZSKs^**...?

/>

^{* Whilst I could run a shadow/hidden
master on e.g. an outsourced VPS, I dislike the overhead of having to secure / manage /
monitor / maintain yet another system; not to mention the additional financial costs of
so doing.}

^{** Okay, this
would enable a determined attacker to replay expired records—but the risk and impact of
such are both tolerable in the case of these
domains.}