[borando]

The system scales up by piggybacking on DNSSEC

You're missing the major point: MinimaLT will initially use X.509 (since it's already deployed). A future protocol upgrade will support, if I'm not mistaken, sayI.

DNS Security (e.g. DNSCurve, DNSCrypt, or even DNSSEC) adds a second layer of security: keys are transmitted in DNS records, and server auth is done via X.509.

This means an attacker would have to break both X.509 _and_ DNS.

I'm not sure if this is more secure; in fact, I think it's less secure than SSL

I believe the above point addresses your concern. In addition, MinimaLT's Curve25519 + Salsa20-Poly1305 is superior to any ciphersuite found in TLS.

[jude-]

Okay, that was not immediately clear. Thanks! :)