Comment by chopin

DNSSEC has the problem that you rely on root certificates as well - which are ultimately controlled by state actors. Where this goes we know already.