2 ms·
DNSSEC use another chain of “ca”, not the root ca like those in browser. It is another complexity. Not sure it help in general and as said here not even dns hi
by ngcc_hk 8y ago
DNSSEC use another chain of “ca”, not the root ca like those in browser. It is another complexity. Not sure it help in general and as said here not even dns hijicking. What is its point is still not sure.
- tptacek 8y agoWorse, those "additional CAs" are de facto and in many cases de jure controlled by world governments, many of whom (including my own) have demonstrated repeatedly their willingness to tamper with the DNS to achieve policy goals.