DNSCurve also provides integrity. It cryptographically authenticates all DNS responses.<p>With DNSSEC yes, you can store signed data on a server without having to store the key on the same machine. It does make it even more complicated, however.
With HTTPS, IMAPS, SMTPS etc we&#x27;re also fine with storing the key on the server, why not with DNS?<p>If you&#x27;re worried about the key being stolen you can always store it in a HSM to limit the damage of a server compromise.