[remram]

DNSSEC already provides attestation, why add another layer within the same system?

[c4mpute]

Because a DNSSEC attestation is usually public, except if you maybe use NSEC 3 and hide the RR behind some random name.