Comment by yuhong

DNSSEC has several problems some of which is in the design, as tptacek likes to mention.