[josephg]

Encryption and signing don't protect against memory corruption.

For example, I download software from the internet then hash it. The hash matches. Before the bytes are written to disk locally, a bit flips in RAM. The corrupted data is written to disk and used.

Likewise, dnssec doesn't protect you against DNS bitsquatting attacks[1] because the domain name can be changed before the DNS request is made. So the DNS response your computer makes for a-azon.com might be totally valid and signed. It can come through DoH or whatever. The problem is that your browser thought it was the response for amazon.com and chrome send a bitsquatter your amazon cookies. (Oops).

[1] https://www.youtube.com/watch?v=9WcHsT97suU

[littlecranky67]

Well aware of all of that, but it decreases the chances if corruption (ie no corruption during download).