I don’t know that I’ve read much support for “entirely happy” but the key difference is that DNSSEC is much harder to upgrade. You didn’t need to wait for my IS

I don’t know that I’ve read much support for “entirely happy” but the key difference is that DNSSEC is much harder to upgrade. You didn’t need to wait for my ISP to upgrade their DNS server before you could stop using PKCS12, and you definitely didn’t need me to upgrade my operating system. The most important work to put in isn’t tweaking DNSSEC but changing it from the pre-PC Internet model where everyone completely trusted their network operators – pushing signature validation out to the client and changing the operating system APIs to make better user interfaces possible.