TSIG to protect secondary external zone

[#1]

Hello,

I would like add some scondary external DNS servers to a zone and raise the security adding a TSIG key.

I haven't reall cath how I should configre the TSGIG.

In fact I can associate a TSIG with every esternal secondary server while I add them to zone or set it in the tab Zone Transfer setting an ACE and overriding the inherited value from the grid.

Which one is he right way? Is there any difference?

Thank You

Regards