[hueving]

And how exactly do you think rotating a TLD key will help if it's obvious that TLD will just give the new key to the NSA anyway?

[throwaway2048]

the same way it can help in the case of the CA, parties like Google will set strict standards + see them compiled with or DANE etc will be ignored from the suspect TLDs.

[tptacek]

What does it mean to "set strict standards" on .COM? Google can eliminate whole CAs, or scope them down to only a subset of names. It can't do that with .COM.

[throwaway2048]

it can however refuse to allow DANE to be used on .COM/other TLDs + apply immense political pressure.

[tptacek]

If you're not going to allow DANE on .COM, what's the point?