It requires the trust of the DNS roots. Which is pretty neat actually: <a href="http:&#x2F;&#x2F;www.root-dnssec.org&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.root-dnssec.org&#x2F;</a><p>And it requires your registrar to not try to perform a malicious attack against you. But at that point, most registrars already have access to a root CA, and your domain - they could easily break your environment.