"its real use case, that of replacing the CAs with DNS TLD operators, has the net effect of signing Internet cryptographic trust over to the world governments that control the most important TLDs."

Exactly! A rare time when we couldn't agree more. I've taken shit on various forums when saying something similar but it's quite obvious when you look at its structure and where the trust is.

EDIT to Add: I'm bookmarking your writeup on DNSSEC. Great summary of the issues. :)