Ok. Here's one. It's a very common C function that appears in some way/shape/form in most client software deployed on the Internet:

  int 
  connect_host(const char *host, u_int16_t port) { 
    int sock = socket(AF_INET, SOCK_STREAM, 0);
    if(sock >= 0) { 
      struct sockaddr_in si;
      memset(&si, 0, sizeof(si));
      si.sin_family = AF_INET;
      si.sin_port = htons(port);
      si.sin_addr.s_addr == inet_addr(host);
      if(si.sin_addr.s_addr == INADDR_NONE) { 
        struct hostent *hp = gethostbyname(host);
        if(hp) {
          memcpy(&(si.sin_addr.s_addr), hp->h_addr, 4);
        }
      }

      if(si.sin_addr.s_addr != INADDR_NONE) { 
        if(connect(sock, 
                  (struct sockaddr*)&si, sizeof(si)) >= 0) {
          return(sock);
        }
      }
      close(sock);
    }
    return(-1);
  }

Tell me something. In the world we live in now, with 10's of well-known mainstream CA's, I see an SSL certificate warning on an otherwise totally OK site about once a month. DNSSEC supposes a world in which everyone runs their own CA; in other words, a world in which there are tens of thousands of CA's.

Where, in that function, do I (a) detect a DNSSEC failure, (b) propose to the user the untrustworthy - but - probably - totally - valid address we got instead, and (c) pop up a dialog to the user to allow them to decide whether to connect? Or, instead, does all this deployed code fail in exactly the same fashion as if the host didn't exist?