DNSSEC has a 1024-bit RSA root after Web PKI ( at least Mozilla-flavored) no longer did. Are the TLDs audited like CAs? Having to change the domain name to eva

DNSSEC has a 1024-bit RSA root after Web PKI ( at least Mozilla-flavored) no longer did. Are the TLDs audited like CAs? Having to change the domain name to evade the TLDs bad security practices is more disruptive than switching CAs.