You might not want to carry that argument any further, since Verisign, which I presume you mean, is the single biggest CA today. They can sign anything.

They can not, however, subvert the root zone any more. Not since it was singed in 2010.

DNSSEC advocates fetishize the security of the root zone, but are conspicuously silent about the trustworthiness of the DNS domains that really matter: .COM, &c.

Since you replied to my comment, I just want to point out that I am not an "advocate" for DNSSEC, neither do I "fetishize" the security of anything.

What I do is to point out that with today's domain validated model, it would make a lot more sense to restrict the validation path to only includes authoritative information about the domain, and to do so in a way that is cryptographically secure.

The fact here is that Verisign can sign anything, today. They can not, however, impact the validation chain that DANE provides.

There are also many millions of use cases where .com does not matter at all.

If they control the keys for .COM, they absolutely can do that.

Name an important domain, and let's see what world government controls its DNSSEC keys.

It is a bit tiresome to write in this thread, with constant insinuations like "those who control .com control every domain" and "key pinning hasn't been dependent on trust-on-first-use for ages", but which are never spelled out. I'm not sure there are any further insights to gain.

If you'd like, I will name an important domain with a trivial use case: skatteverket.se. It it the agency responsible not only of taxes but of nearly all personal data: marriages, deaths, everything. They have stringent security requirements for this, and to their users their security is infinitely more important than that of, say Facebook for example.

In what way would their adoption of DNSSEC cede control of anything to the NSA, or to anyone?

In a thread about user privacy and government control, I asked you for an example of a domain whose TLD might have some influence over how secure it would be post-DNSSEC. You provided the domain of a government agency.

I think we can be done now, don't you?

This thread is about the usefulness of DNSSEC. If you have another agenda than please be explicit about it so that we can have a fruitful conversation.

You asked for a domain, any domain, and was prepared to show how Verisign could exercise their control over .com and somehow affect the validation path that DANE provides. At least that's what how I understood you. It's not always clear.

You seem to argue that susceptibility to state level actors is a counterargument to the standard, so I gave one of the few examples I know of who really need to protect against such adversaries.

Apparently my example was somehow a bad one. Take one of the big banks instead then? What could happen to swedbank.se if they signed their delegation with their TLD?

Or why don't you provide an example instead, and show in what way signing it would cede control to the NSA, or to anyone else?

Examples:

* Every .COM

* Every .CO.UK

* Every .COM.AU

* Every .IO

* Every .ORG

Your response:

* The Swedish tax authority's site.

Of course Verisign controls .com. That was never in question.

Again, there are millions of use cases where .com doesn't matter.

You alluded to some control that some large entity (which I only assume to be Verisign) exercise over every important domain. I take it that was never the case?

This is just one reason why I'd love to see the creation of many thousands more TLDs. The importance of ".com" was always a temporarily contrived contingent condition, a false scarcity perpetuated in the seeking of rent. The sooner that's over the better.

(Expecting users to read URIs was always a losing tactic, but surely everyone knows that now with IDNs.)

because i would rather have to deal with the NSA, than everyone else + the NSA.

The level of tampering required for the NSA to fake DNSSEC replies is very evident if you have the cert pinned, and very hard to deny.

As things stand, its very easy to deny it was the NSA when anyone and their dog can have access to a CA cert.