because i would rather have to deal with the NSA, than everyone else + the NSA. The level of tampering required for the NSA to fake DNSSEC replies is very evid

because i would rather have to deal with the NSA, than everyone else + the NSA. The level of tampering required for the NSA to fake DNSSEC replies is very evident if you have the cert pinned, and very hard to deny. As things stand, its very easy to deny it was the NSA when anyone and their dog can have access to a CA cert.