Okay, so this is what happens:<p>1. Evil NSA compromises CA in BFE<p>2. Evil NSA subverts DNSSEC for COM to publish a bad CA certificate<p>3. Some combination of Google Certificate Transparency + HPKP discovers this, the CA in BFE gets removed from browsers<p>If your point is &quot;DNSSEC is pointless&quot;, OK. But it sounds like you&#x27;re saying it makes us <i>less</i> secure. I&#x27;m just trying to figure out how that could even be.