You can make your DNS server ignore root certificate and use anchors stored locally for specific TLD. If then you contact a TLD that's owned by 3rd party you e

You can make your DNS server ignore root certificate and use anchors stored locally for specific TLD. If then you contact a TLD that's owned by 3rd party you essentially trusting whoever owns that TLD. For example .google is owned by Google, so whatever is under it is under their full control.