In addition to DoH, there's already a direct-to-domain-registrar protocol in the works for the CA problem.
DNSSEC is, I think, pretty much dead.
”there's already a direct-to-domain-registrar protocol in the works for the CA problem”
Sounds interesting. Are there any drafts/discussions available?
You're looking for discussions about RDAP, the successor to WHOIS.
Not sure about this phrasing. It's not on the domain owner to maintain anything, you just need to not forget you have DNSSEC enabled if you move your zone to different NS.
It's up to your DNS host to handle things like key rollovers and most people aren't writing and running their own authoritative DNS servers.
Regardless, the risk vs reward is still heavily in favor of not signing. It is so sparsely deployed that it can't be relied upon for anything (like DANE) and it seems like DoH (both for clients and between resolvers) may end up being the better way forward.