Just a reminder that DNSSEC doesn't do much of anything to protect Internet privacy --- all it does is sign queries, it doesn't encrypt, and the signatures are with keys effectively escrowed to the owners of the TLDs (most frequently, world governments).