It seems patently obvious to me that if they had the luxury of a clean slate design (which they do, but have denied themselves in as clear an instance of what Sartre would call "bad faith" as I've seen since I was forced to read Sartre in high school), the IETF would come up with a very different system than DNSSEC. They'd eliminate the "offline signer" requirement and come up with a massively simpler system.

Instead, they took a dented-up whiffle ball of a protocol that some rando at TIS Labs hucked over to them in 1995 and have spent the last 20 years trying to play Major League Baseball with it by wrapping more and more duct tape around it.

I don't think a lot of DNSSEC advocates really appreciate how clear the lineage of this protocol is back to a DoD contract project from the 90's. That really is what they're trying to deploy.