It's true that DNSSEC isn't a cure-all - but it's better than a third-party SSL CA. As-is, Libya can still control bit.ly's TLS key by changing bit.ly's NS reco

It's true that DNSSEC isn't a cure-all - but it's better than a third-party SSL CA. As-is, Libya can still control bit.ly's TLS key by changing bit.ly's NS records over to servers under their control, picking a random CA and having it auto-mint some certificates, then changing it back before anyone notices. So that security issue was always there. The issue that DNSSEC fixes is where an evil (or hacked) CA creates a certificate for a domain they have not verified at all. There is no way for the true owner of the site to indicate which CA they're using, so browsers are forced to trust all of them - leaving way too many points of failure. This is actually worse than your libya issue - many governments have their own CAs, making it downright trivial to make a certificate for google or something. By tying authentication to DNS, there is a single point that needs to be compromised; you no longer have a choice of which CA to hack or coerce. And the site owner also has the ability to choose a registrar and TLD they trust, knowing that some totally unaffiliated registrar or TLD cannot intervene.