How is that worse? You already have US government in your CAs, for example Federal Common Policy CA. At least with DNSSEC only the organization that owns the TLD can issue certificates. With CA system in the browsers a country you might never heard of can issue certificate for google.com (which already happened).<p>Yes, the danger could be root certificate is managed by a single organization, but this can be easily solved in software of DNS server (for example ignore root and store certificate for every TLD, or implement policy to trust it only for certain TLDs). I would not be surprised if that&#x27;s already implemented.<p>Now with ICAAN move (which I personally am not a big fan of) there are TLDs that are owned by private organizations, so it is possible to have entire chain without any government being involved in it.