DNSSEC is adding a cryptographic-trust-negotion layer to DNS. Governments are in control of DNS, ergo governments would be in control of the new layer which DNS

DNSSEC is adding a cryptographic-trust-negotion layer to DNS. Governments are in control of DNS, ergo governments would be in control of the new layer which DNSSEC adds to it. DNSSEC is adding a means of cryptographically verifying the government control already implicit in DNS. The way to keep government controls away from your own cryptographic trust negotiation is not to not implement DNSSEC but to implement your own DNS root with its own DNSSEC* , or to implement your own orthogonal trust negotiation such as the various PKI models currently in use. [* ] Before anyone argues, this is exactly what you do when you host a domain in your own DNS server. The vast majority simply defer the rest of the DNS to 3rd party resolvers. I'm sure DNSSEC is able to cope with a situation wherein you own and host only a subdomain and keep the DNS hierarchy above you from being able to override or in any way interfere with your DNSSEC controls.