[Pdns-users] Prevent external lookup of (private) subdomains

[informant at trinaxab.se]

I'm not too familiar with DNS updates, but am I understanding it correctly that it would be setup like so:

I set up two different DNS servers, one public and one private. I delegate int.example.com to the public server in our global DNS. The private server will serve the actual subdomain records, and will send DNS updates to the public server. (in order to respond to ACME challenges?)

Where can I find info on how to set up the TSIG keys and DNS updating on both ends?

I have seen these, but do they cover everything? Because I still don't know where to start.
https://doc.powerdns.com/authoritative/dnsupdate.html
https://doc.powerdns.com/authoritative/tsig.html