See in that (old) thread the author's attempts to salvage those arguments. Zach followed up with me after that thread, by the way, and apologized for the tone of the original post you just relayed to this thread. I told him that was unnecessary, because I have no intention of ever being nice about DNSSEC. :)

Exactly what I'm hoping for, by the way. Sounds great. A PKI, controlled by the US Government, with 1024 bit RSA at the top, somehow connected to my PGP keys.

http://blog.easydns.org/2015/08/06/for-dnssec/#weak

"1Kb keys are temporary and the industry is already migrating to 256-bit ECC."

http://blogs.verisign.com/blog/entry/increasing_the_strength...

"With this change, the root zone ZSK size will match the size of the KSK: both will be 2048-bits. One difference, however, is that the ZSK is changed (rolled) four times per year, or approximately every 90 days. The root zone will not be the first to use a 2048-bit ZSK. Approximately 60 top-level domains (TLDs) are known to be using 2048-bit RSA ZSKs already."

The prosecution rests.

Looks like the prosecution might only have a few weeks of rest. :)

I'm pretty comfortable with what this thread says about our respective credibility.

He points out how dnssec puts control in the hands of whatever government controls the domain, and your counter argument is about the strength of keys used to do so.

It makes your argument seem less like an argument on the merits of the issue and whether or not tptacek is a credible voice in the matter. Further, to call his arguments FUD takes you further down a path that is not increasing your own credibility.

http://blog.easydns.org/2015/08/06/for-dnssec/#government http://blog.easydns.org/2015/08/06/for-dnssec/#dane

Basically, whereas any CA (controlled by any government) can issue a certificate for any domain, with DNSSEC you at least get to pick which government you trust to secure your domain (or run your own generic TLD and not trust any government).

My counter argument about the strength of the keys was because he was the first to mention "1024 bit RSA". Did you miss that?

Finally, I used the term "FUD" to borrow the language from that EasyDNS article, the second sentence of which is: "Sadly, there is a lot of FUD out there and we wanted to both debunk that FUD and explain why DNSSEC is vital to the security of the internet." Hopefully people are reading both sides of the story here.