> The registrar controls your keys. I've been managing domains with DNSSEC for several years and I've always had control of my keys. Clarification of who cont

> The registrar controls your keys. I've been managing domains with DNSSEC for several years and I've always had control of my keys. Clarification of who controls what keys [1]: The TLD zone's private keys are managed by the company operating it. For a Country Code Top-Level Domain (ccTLD), the government of the country will be managing the key. For popular TLDs like .COM or .NET, it will be the U.S. government through the operator Verisign. For popular ccTLD .IO, it is the government of British Indian Ocean Territory. The private keys for an individual domain name are managed by the domain owner either directly or via the DNS provider hosting their domain name. With DNSSEC, it is pretty clear who controls the private keys and also keeps the risks involved distributed. Which means while China holds private keys for .cn ccTLD, it can only sign domain names under it. [1]: https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...