DDoSing DNS would break everyone's browser for lulz too, but somehow the net manages to chug along. And if/when it happens, at least people know they're under a

DDoSing DNS would break everyone's browser for lulz too, but somehow the net manages to chug along. And if/when it happens, at least people know they're under attack and direct attention to fixing things. A service with a clear single point to DDoS is obviously the wrong choice. What if services all over the net could tell you the latest (<5 minutes old) root/summary-hash of the shared dataset? And, there are many places to either update yourself to that version, or receive a trustworthy proof a certificate is/isn't in that dataset? If they're all blocked, an alarm should go off, letting the user know it's dangerous to proceed. The failure shouldn't be secret, with the confidence-inspiring lock icon still appearing, for indefinitely long periods.