[tptacek]

I feel like I can't answer this without repeating this post:

http://sockpuppet.org/blog/2015/01/15/against-dnssec/

... or its FAQ.