I think that Dan is heavily invested in trying to "fix" DNS, and that he's arrived at DNSSEC as a way to do that. The problem for him, like most DNSSEC advocat

I think that Dan is heavily invested in trying to "fix" DNS, and that he's arrived at DNSSEC as a way to do that. The problem for him, like most DNSSEC advocates, is that nobody cares about DNSSEC, and so it's not really happening. People are starting to care about CAs, though, and so it seems convenient for DNSSEC advocates to hitch their wagon on a solution to that issue, because it might actually get DNSSEC moving. The trouble is that they don't really get the problem. The problem with CAs today is a lack of trust agility, and instead of improving trust agility, DNSSEC makes it worse. People object that we already have to trust the TLDs and the registrars, that it's already bad, that we're already beholden to parties we wish we weren't. I don't understand how this resonates with anyone -- if we acknowledge that things are bad, we should be trying to move away from that, not throwing our hands up, embracing it, and moving towards it.