This is what's good about DNSCurve; it provides value immediately and deploys incrementally without boiling the ocean, and it doesn't come with a whole new PKI that would (for instance) force every .LY app to trust the government of Libya.