Exactly. And not to mention that we used elliptic curves (so the keys are shorter) and neutered ANY queries (so you can't aggregate records to generate a large DNS response). The net effect it using the CloudFlare DNSSEC implementation for DDoS gets you little to no amplification factor. And that's before the clever things we do around forcing TCP when we expect abuse, etc. Critcize us for many things, but for not thinking through how to mitigate the DDoS risk shouldn't be one of them.