> because "Uncle Sam" has de jure control over the domain names you care about I know, and that's okay, if we knew what are those actual actions, and were ther

> because "Uncle Sam" has de jure control over the domain names you care about I know, and that's okay, if we knew what are those actual actions, and were there a log of those people could decide what to do. To me this sounds like an opportunity to decentralize DNSSEC, skip ICANN, let TLDs pick "trust root providers", make it tamper evident, and the resolvers will maintain the trusted set of roots. Or not, and just don't put keys into DNS and learn to live with the additional network round-trips required for the workarounds. :( (Like MTA-STS, which, on the other hand, is great. Relatively easy to deploy, opt-in, has a time-lock like HSTS, so sort of resilient. But still a workaround.)