Also, DNSSEC does have one thing PKIX doesn't and can't have: QName minimization. That's where instead of sending the full domainname for any query to the root

Also, DNSSEC does have one thing PKIX doesn't and can't have: QName minimization. That's where instead of sending the full domainname for any query to the root and all intermediate zones, you only ever ask each zone for its domainname + the next label of the domainname you really want. Imagine you're a subject of interest to the U.S. government, and they're willing to risk public knowledge of their access to root keys, say, in order to spy on you. And say you're vising some site like antifa.github.io. So you ask . for io, and io for github.io, and github.io for antifa.github.io, and only at the last hop can the LEO/TLA system spying on you decide that yes, they want to MITM you there. So either they have to MITM you everywhere, or they have to MITM you only at zones they can control, and this is a decision they have to make online. That's a big deal. If they decide to MITM you when you asked for io, but you expected this so you had io's public keys, and . tells you different keys, then you've detected the espionage attempt. WebPKI can't do this. By the time some server (or MITM) sees your SNI they've also seen your DNS queries. Even if you're using DoH/DoE (which also gets you similar protection in a DNSSEC world), if the SNI is not encrypted, still, they know what to do. And so on. Let's say you're using DoH/DoE with a resolver the LEO/TLA can't control, then they could simply kick your door in and take your stuff and beat you up. Crypto can make things harder for them, but not infinitely harder. The CCP won't give a damn about leaving evidence in CT logs, for example -- maybe today they do, but when push comes to shove, forget about it.