&gt; A DS record doesn&#x27;t indicate a connection between an organization and a domain though, which a traditional CA supposedly might.<p>Only if you get an EV certificate, no? My understanding is that the only checks required for getting a normal certificate issued is to verify that the person holding the key that you&#x27;re signing is in control of the domain. (Verified through methods such as setting particular DNS records, proving control of the email on the WHOIS data, or setting up an HTTP server at a particular DNS address.)<p>Then again, most sites just use a basic cert, so perhaps DNSSEC provides most of what is needed.