I agree that it wouldn't be a good idea to use this, unless you had configured the local resolver with overrides for the DS records forthe domain (to avoid the risk of ICANN / TLD (registry) / registrar malfeasance), but at that point, why not setup a private CA to sign the user keys? I guess maybe you wouldn't get easy distributed key revocation that way.