I'm really puzzled as to why signed hashes have not essentially fixed the problem for people with largely static sites, like Krebs, AFAIK. No one needs to know

I'm really puzzled as to why signed hashes have not essentially fixed the problem for people with largely static sites, like Krebs, AFAIK. No one needs to know how Krebs feeds new signed versions of his website into a proxy cache of at least one ISP, then the resources to block it somewhere are the resources to bring down an ISP from within its clients. In many respects, Akamai is (or was?) that proxycache system and all that is broken is viewing it as an independent entity that doesn't inherently have to have greater resources than all compromised clients. If every ISP were providing that replication for the most hit (such as most attacked) sites then offlining sufficient hacked clients to keep their cache running becomes an entirely local problem.