Statement on DNS Encryption [pdf]
I know DNSSEC has a ton of flaws and has received a lot of justified criticism. But I&#x27;d still desperately love to be able to have good standards in place such that my possession of a given domain also allows me to operate a generally recognized private CA off of that for said domain (as well as elimination of a variety of DNS attacks of course). There shouldn&#x27;t need for 3rd parties there in principle, it should be enough to just be able to put up a CA root public cert up in DNS and have everything automagically work from there. It&#x27;d make a host of things like RADIUS and future enhanced distributed auth email-likes a lot more convenient and less fragile. I love Let&#x27;s Encrypt, but it&#x27;s a bandaid for the fundamental issues with DNS. I hope increasing recognition of the centrality of DNS and need for improvements there will ultimately result in something modern and better than DNSSEC that can move a lot of stuff forward.