That one registrar is chartered and controlled by a government; for much of the Internet, that government is the United States, which already has a system in place for seizing control of domain names. I'm baffled that people could be sanguine about also giving them control of encryption certificates.
DNSCurve doesn't authenticate DNS data. It authenticates the connection between the client and the server. It does that because authenticating the data requires boiling the ocean by getting a huge portion of the Internet to agree on and implement a scheme to authenticate data, and authenticating individual connections works even if you and your server are the only people who agree to do it. DNSCurve solves a less ambitious problem than DNSSEC does, but that problem is (a) the most important problem in DNS security and (b) actually solvable, unlike the DNSSEC problem.
Plus, your DNS provider doesn't have a business incentive to prevent you from bootstrapping other systems off DNS. So it happily could put eg per host IPSEC keys, or SSH host keys in strongly authenticated DNS records.
I thought the problem with CAs was that any compromised CA breaks security on all sites? Whereas with DNS there's one registrar that handles your domain (well, plus the tld admin, but that's still only 2 instead of lots), which is chosen by you rather than any attacker?
The better technology to look into if you're concerned about individual user rights and privacy is DNSCurve: http://dnscurve.org
After re-reading that, I still don't see how it authenticates the DNS server (and if it does, I imagine it could only do so by relying on information from the parent zone). So I'll assume that it's no more resistant to "registrar hack[s] or state level strong-arming" than anything else.