It requires the trust of the DNS roots. Which is pretty neat actually: http://www.root-dnssec.org/ http://www.root-dnssec.org/ And it requires your registrar t

It requires the trust of the DNS roots. Which is pretty neat actually: http://www.root-dnssec.org/ http://www.root-dnssec.org/ And it requires your registrar to not try to perform a malicious attack against you. But at that point, most registrars already have access to a root CA, and your domain - they could easily break your environment.