Other problems with DNSSEC aside, the crazy thing here is the suggestion to replace the Web PKI with a system that has taken longer to migrate towards safe key

Other problems with DNSSEC aside, the crazy thing here is the suggestion to replace the Web PKI with a system that has taken longer to migrate towards safe key sizes than the existing solution. 1024-bit keys for end-entity certificates were deprecated in 2013 and the last 1024-bit roots were pulled in 2014-2015 (ish?). I don't feel like the CA/B Forum is a particularly fast-moving body, so this is pretty telling.