I think talking about key sets is making this complex. In the simplest case a zone has a single signing key pair which signs all RRSETs in the zone. When using a single key this is called a CSK. For operational management purposes that signing may be separated into two steps, signing records which create the link in the trust tree with a KSK, and all other records in the zone with a ZSK. Additionally, when migrating one key to another there may be a second key of that "role" in the zone temporarily, or perhaps even a third for some multi-signer setups I believe. But as far as resolvers are concerned each RRSET in the zone needs to be verifiable using at least one of the zone apex DNSKEY RR public keys.