Indeed that would work. In theory. Especially since we thought of that use case (delegation into DNS) with the GNS2DNS record type. There is a BUT: You need an

Indeed that would work. In theory. Especially since we thought of that use case (delegation into DNS) with the GNS2DNS record type. There is a BUT: You need an initial label for ICANN zone to resolve the names. Unless you have a resolver implementation that "hides" the zkey of ICANN in the UI. But technically, under the hood, a name for this ICANN zone would look like: www.example.com.THEICANNZKEY... ICANN could also publish the TLDs individually as zones, however, and you could have an "ICANN Start Zone" (see Start Zone in the RFC) consisting of the TLD/zone key mappings.