I don't understand why that's in the headline outside of being clickbait. The article itself mentions that meetings of the DNSSEC key holders are quarterly and regular, and that the hardware involved in the actual key rollover complies to the highest level specified by FIPS-140 (presumably actually FIPS-140-2).
I don't believe there's reason to be worried; the ICANN has historically taken reasonable precautions to ensure the safety of such meetings and exchanges.
Eww, FIPS-140-2.
FIPS-140 compliance isn't a selling point. It's more of a genetic marker than anything. Most of the time, it signals to hackers, "we value standards compliance over security."
Did you know that ECB mode is FIPS-140-2 approved, but AEAD modes (i.e. what you should be using to encrypt) such as GCM and OCB are not?
Yes, that ECB mode. https://blog.filippo.io/the-ecb-penguin/
But in reality lookups to the root DNS zone are very uncommon; resolvers perform them only when occasionally boot-strapping the name-servers for the TLDs.
An attacker using a poisoned root zone to take over your traffic would have to wait between two days and a week for it to work, so it's not very interesting for a direct attack. A mass poisoning is even less useful: there is a relatively small number of TLDs and any false answers would be detected very quickly (the occasional operational mismatch is reported within minutes on DNS operations mailing lists). And if your goal is to block some DNS names, as happened in Turkey a few years ago, it's easier to simply drop the queries and responses for the domains you don't like; signing doesn't provide any help at all. Bottom line: the root zone is not very security sensitive, there aren't interesting attacks to mitigate in the first place, and none that TLS/SSL don't take care of.
Queries against the TLDs on the other hand are much more common; but what are the procedures for the .com/.net roll-over? or .ly? where are the live-video feeds for that zone signing ceremony? are there people walking around with Shamir-split copies of those keys around their necks and wearing them as if they were the guardian of the internet?
With that in mind, shouldn't meeting those specifications be seen as an antipattern?
[1]: http://marc.info/?l=openbsd-misc&m=139819485423701&w=2
And relevant HN thread: https://news.ycombinator.com/item?id=7634964
The only thing I see as a potential concern is that many DNS implementations build the root public key into the server, either at installation or at compile time.
The processes for rotating that key will be tested in the wild for the first time. I can only assume that some set of build/installation processes will have an undiscovered bug during this procedure.
Is it a big deal? Not really, I bet it would be fixed within a few hours.
Does the key change frequently?