> You are right, if you can compromise a registrar that permits DNSSEC to be disabled (without notification/confirmation to POCs
> etc), then you only have a limited period (max of DS TTL) of protection for those resolvers that have already cached the DS.
As far as I can tell, that's roughly all of them. If you have the
credentials to log in and change the NS, you can change or remove the
DS, too.
And, that wouldn't change in the nearest future, because the concept of "hostile pinning" as it was present with HTTPS Public Key Pinning could also be ported to DNSSEC this way.
"Hostile signing"... doesn't that sound scary.
--
Töma