> but don't keep up maintenance of it Not sure about this phrasing. It's not on the domain owner to maintain anything, you just need to not forget you have DNS

> but don't keep up maintenance of it Not sure about this phrasing. It's not on the domain owner to maintain anything, you just need to not forget you have DNSSEC enabled if you move your zone to different NS. It's up to your DNS host to handle things like key rollovers and most people aren't writing and running their own authoritative DNS servers. Regardless, the risk vs reward is still heavily in favor of not signing. It is so sparsely deployed that it can't be relied upon for anything (like DANE) and it seems like DoH (both for clients and between resolvers) may end up being the better way forward.