> Regarding your first point: no, they can't. See what happens if they try to exploit the DNS to get a Google certificate. (Notice the last several years of Goo

> Regarding your first point: no, they can't. See what happens if they try to exploit the DNS to get a Google certificate. (Notice the last several years of Google punishing CAs). What? Article about it on HN? They won't punish CAs for that, because that won't be CA fault that USG modified DNS zone. > It is very important to DNSSEC advocates to convince people that our security can't be any better than the security of the .COM zone, which is controlled by the US Government through Verisign. But nobody accepts that level of security today. Arguments that we can escrow all our security with Verisign are DOA, post Snowden. Move on. Because it can't be better with DNS, which is by design hierarchical. You would have to create own domains as TLD in root zone. Oops, you now have to trust root zone owners! So you can create blockchain based domain system. But, it won't be DNS. And you will argue that implementing blockchain name system is even more expensive to implement than DNSSEC, because it is slow and requires big storage space. > Regarding the rest: you can't persuasively rebut arguments by conceding they're correct. Last mile problems aren't covered with DNSSEC, there is other RFC for that.