No. (a) is wrong.<p>The difference between DNSSEC&#x27;s government-controlled super CA and a normal TLS CA is that when Google spots a normal TLS CA misbehaving because of an alert from a broken pin or CT log, it can shitcan the CA, either evicting it from the trust store or placing onerous restrictions on it. Both of these things have happened and will keep happening.<p>Google cannot do that to .COM or .IO. If the government-controlled super-CA that runs .COM misbehaves, we have <i>no recourse</i>.<p>DNSSEC essentially takes the worst feature of the HTTPS trust model and <i>bakes it permanently into the core fabric of the Internet</i>.