DNSSEC Bind-9.11 auto-manage and inline-update

I am trying to understand how Bind manages DNSSEC zone key signatures without external intervention. Specifically what process (named?) detects that a zone signature is about to expire and what are the methods of detection and resigning.

Does named itself regularly poll all the zone keys and then spawns an update process? Are there settings beyond those listed below required to get auto-maintain to work? Does the update have to triggered by rndc or reloading named?

. . .
options {
  . . .
  dnssec-enable yes;
  key-directory "/usr/local/etc/namedb/master/";
  dnssec-validation auto;
. . .
}
. . .
zone example.com {
  type master;
  file "/usr/local/etc/namedb/master/example.com.hosts";
  key-directory "/usr/local/etc/namedb/master/";
  auto-dnssec maintain;
  inline-signing yes;
};