[tptacek]

Because almost nobody in the real world uses DNSSEC, there's a standard in the works that addresses this threat more directly:

https://datatracker.ietf.org/doc/rfc8461/