I thought about that, but there's so many DNS caches out there with potential bugs to make them insecure and poisonable. But a set of public keys from the regi

I thought about that, but there's so many DNS caches out there with potential bugs to make them insecure and poisonable. But a set of public keys from the registrar is "content". It's small, so they could just have a server or two to handle it. (But if load/latency was an issue, well everyone's pretty good at content-distribution networks these days...)