Hacker News Reader

The DNS root servers need offline signing. Many servers are in untrusted areas (think intervention from local government).

I think DNSSEC already deals with this by offline signing another key that actually signs the DNS root zone.