> DNSSEC is a hierarchical PKI, like the CA system. Just off the root of the DNSSEC hierarchical PKI are a series of branches that are controlled entirely by wo

> DNSSEC is a hierarchical PKI, like the CA system. Just off the root of the DNSSEC hierarchical PKI are a series of branches that are controlled entirely by world governments. I am assuming you are talking about the country-code TLDs (ccTLDs) here, correct? I agree that certainly many of those ccTLDs are directly controlled by governments while many others are operated on behalf of governments. The generic TLDs (gTLDs) are different and are mostly operated by private companies operating registries under contact with ICANN. With the "new gTLD" program there are now MORE gTLDs than there are ccTLDs. > I don't know how to say this any more clearly without sounding patronizing. In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. Simple answer - if you don't trust the Libyan gov't, don't use a .LY domain! I would argue that in DNS in general you do need to trust your parent zone. If you don't trust them, don't use them. Period.