Not really. In theory the zone signing could be done as a separate process from zone updates, but I don't think any DNS provider implements this - they hold the

Not really. In theory the zone signing could be done as a separate process from zone updates, but I don't think any DNS provider implements this - they hold the keys, not you. The other attacks used compromised domain registrar accounts, where the attacker could just disable DNSSEC or switch the nameservers to whatever.