DNS is already a a distributed chain of trust. I trust that the well know ftp site will give me a good hints file to get to the root servers. I trust that the root servers will provide me with the proper ns and glue records for the tld servers. I trust that the tld servers will provide the correct ns and glue records for the domain I want to resolve. DNSSEC just formalizes the trust with digital signatures.<p>A traditional CA validates empirically that a customer controls a domain at some point in time. DNSSEC is a stronger validation of control of the domain, because it&#x27;s a property of the domain itself.<p>Trusting the domain registry to indicate who controls a domain makes a lot more sense to me than trusting a third party. If I can&#x27;t trust the DS records, I can&#x27;t trust the NS records either.<p>A DS record doesn&#x27;t indicate a connection between an organization and a domain though, which a traditional CA supposedly might.