Hacker News Reader

Yes.

That would force companies to either own all of the front-end server farms or store their keys on machines in untrustworthy environments.

Yes: a choice between two very unattractive options. Isn't DNSSEC great?

Uh? You can run everything in offline mode, unless you really care about trivial zone enumeration.

I am not talking about the current DNSSEC, of course.

I.E. the way SSL/TLS is run today.