One thing I love about DNSSEC threads is that I get to join the anti-NSA faction on HN. Unlike you, I do <i>not</i> trust the giant corporation that controls .COM under charter from the US Government.<p>The USG has repeatedly abused its trust, often directly with respect to .COM. The Internet has not fled .COM.<p>The idea that we would deploy a forklift upgrade of a core protocol, at immense expense (look at Cloudflare&#x27;s own marketing material!), ostensibly to improve security but in reality to put ourselves in the position of &quot;fleeing .COM <i>IF</i> the US Government abuses it trust&quot;, boggles my mind.<p>The problem DNSSEC purports to solve is not cryptographically hard. DNSSEC made it hard because it was designed in 1995, at a time when designers felt it would be implausible for DNS servers to sign records.<p>We are talking about deploying this fiasco of a protocol with all its compromises purely because of the momentum of a 21+ year long standardization effort. Once we deploy it, any notion of solving the problem correctly dies. That&#x27;s a terrible, terrible mistake.