Plus, your DNS provider doesn't have a business incentive to prevent you from bootstrapping other systems off DNS. So it happily could put eg per host IPSEC keys, or SSH host keys in strongly authenticated DNS records.