(throws caution to the wind...) DNSSec is not dumb. The gap you're pointing out is valid for most standard user OS's that are not performing DNSSec validation

(throws caution to the wind...) DNSSec is not dumb. The gap you're pointing out is valid for most standard user OS's that are not performing DNSSec validation and/or are not using private/secure/authenticated channels to their upstream resolver. DNSCrypt and DNS over TLS solve the later. But, there's no reason that users can't run validating Resolvers locally as well, thus filling in the gap you point out. Now, most users and OS' out there don't provide these capabilities, so the gap you point out is 100% accurate based on the current state of the world. But, shouldn't we fix this and start bringing the validation to the end user OS'? tptacek's criticism's are more on point, b/c they get to the heart of some issues in the deployment and actual security of the DNSSec network, and these are foundational issues that we need to resolve. I'm optimistic that we can solve them and I don't think we should give up just b/c it's non-ideal today.