DNSSEC would help here. NetSol's rogue nameserver wouldn't be able to produce
the signed zone if validation were required.

Nope, they could just remove the DS since they are the registrar for that domain. DNSSEC only protects against a DNS provider going rogue, not your own hired registrar.

Rubens