&gt; <i>[...] but that it&#x27;s literally not what the protocol is designed to do.</i><p>&gt; <i>the DNSSEC protocol is explicitly not designed for end-user verification</i><p>&gt; <i>This is literally a matter of what problems DNSSEC is even aimed at solving.</i><p>Repetition doesn&#x27;t make that argument any more valid. If DNSSEC wasn&#x27;t intended to have this capability, it&#x27;s for the same reasons that it wasn&#x27;t intended to be used for on-the-fly signing: it was designed in the mid-&#x27;90s when that was impractical. Nowadays it <i>is</i> practical and it <i>does</i> in fact work just fine for this purpose, and it provides an extra layer of defense in depth and stops some attacks sooner than TLS can and provides some added security to things that aren&#x27;t using TLS (because remember, there&#x27;s more to the Internet than just the WWW, and many of those things don&#x27;t have the aggressive upgrade cycle that Chrome uses).