Exactly this. DNSSEC is needlessly complicated in large part because its service model was fixed in the mid-late 1990s, when the conventional wisdom was that DNS servers would never be powerful enough to actually perform cryptographic operations. A true DNSSEC 2.0 could simply forego the concept of offline signers (which has largely been foregone already, because online signing is necessary to serve secure NXDOMAINs without revealing all your hostnames) and sign/encrypt on demand.

But DNSSEC 2.0 is unlikely to happen, because DoH solves most of the real-world on-the-wire problems with DNS security. There have always been two visions for how to secure the DNS: the top-down way, with signatures rolling down from the roots, a la DNSSEC, and the bottom-up way, where leaf servers allow individual clients to make secure queries, and we gradually converge on a secure DNS as more and more leafs make secure queries available. Top-down won at the IETF, but bottom-up is going to win the market.