DNSSEC proves nothing about correctness, it just helps show that a record was published by someone with access to the private key pointed to in the DS record.

DNSSEC proves nothing about correctness, it just helps show that a record was published by someone with access to the private key pointed to in the DS record. What's "correct" or not is an entirely more nebulous thing.