Comment by jingo

"... armour the requests themselves to make sure that they don't become the new vector, they don't become manipulated."

I interpreted this to mean encrypting each DNS packet.

Maybe I misread the statement?

DNSSEC of course does not protect the contents of the packet.

Instead, DNSSEC more or less is just another CA system (or an adjunct to the existing one), running over UDP.