[tptacek]

Are you sure about the DNSSEC thing there? The overwhelming majority of deliverable domains aren't DNSSEC-signed (because the overwhelming majority of all domains isn't).