I agree that it wouldn&#x27;t be a good idea to use this, unless you had configured the local resolver with overrides for the DS records forthe domain (to avoid the risk of ICANN &#x2F; TLD (registry) &#x2F; registrar malfeasance), but at that point, why not setup a private CA to sign the user keys? I guess maybe you wouldn&#x27;t get easy distributed key revocation that way.