> If you're a user, you can't use bit.ly services with DNSSEC without trusting the .ly TLD, right ? True, although you can remove the "with DNSSEC" part. You

> If you're a user, you can't use bit.ly services with DNSSEC without trusting the .ly TLD, right ? True, although you can remove the "with DNSSEC" part. You can't use bit.ly (or any other .ly) without trusting the .ly TLD. Interesting, I wasn't thinking about it from the user point of view - I was thinking about it from the domain registrant who is publishing a DNS zone under .LY. But you're right that it equally applies to the end user from the client perspective.