The DNSSEC proof validation can also be played with at
Provable DNS Querying
Login to reply
Replies (1)
DANE could play a role here to provide transport layer encryption without needing to trust a CA