DNSSEC isn't going to prevent suppression, it just makes it detectable. Cloudflare is still going to send you a doctored record - which will fail verification.

DNSSEC isn't going to prevent suppression, it just makes it detectable. Cloudflare is still going to send you a doctored record - which will fail verification. But that doesn't magically give you an undoctored record, unfortunately.