You should always be aware of political risks when buying a ccTLD. There's precedent that these have caused serious issues for domain holders, one notable example

https://www.theverge.com/2024/2/12/24071036/queer-af-mastodo...

Outages and poor management are one possibility. Other is the fact that you have to trust the country running the ccTLD with DNSSEC keys. This might rule out things like using TLSA/DANE or SSHFP records.

I think more relevantly than DNSSEC, couldn't they issue TLS certificates using DNS-01 validation? You have to trust your DNS registry.

They could, but WebPKI things get logged, doing split-horizon DNS for your victims doesn't.

The gTLDs are also subject to the whims of a foreign country (usually the USA). The safest option is probably your own country's ccTLD, since any dispute would go solely through your own country's laws and courts (to which you're already subjected, by virtue of living there).

Unfortunately, the .us TLD prevents hiding whois, even partially. So registering a domain under that TLD is just asking for perpetual spam.

Which is weird! In contrast, .ca hides whois by default for personal registrations.

And .de is schizophrenic, because a few years back there was a big kerfuffle about WHOIS data being public, as a result of which it is now hidden, however almost all German websites remain subject to mandatory imprint regulations. (The only true exceptions are things of limited public value, such as the log-in pages to password-protected stuff, or at most galleries of holiday snaps for family and friends, although ideally those should rather be password-protected, too. Anything else that's intended for the regular general public is at least in a grey area, even if it remains strictly non-commercial.)