The power users run the DNS caches.
Nobody uses DNSSEC, so it's still easy to poison DNS caches. Power users know how to do this, and can "poison" the DNS caches with the correct entries instead of the government-sanctioned alternatives.
I'm getting some popcorn. This will be fun to watch.
I'm not sure if that's accurate - I believe source port randomization has made it extremely difficult to poison recursive DNS servers. I think a recent "successful" attack on source port randomizing showed it took them 7 hours on a 10Gb/s link to poison one A entry.
Think about how much bandwidth is used every day for downloading porn. Use 1% of that for poisoning DNS, and DNS points wherever the poisoners want it to.
This will not be significantly harder.
By connecting to this tracker, the translation from "www.someplace.com" to 12.13.14.15 (what the machine really understands) is done regardless what the ICANN dns says. No way to redirect to a "this page is closed" server, no web page can be cut off the internet. Check mate.
This game is far from over. Filtering web requests based on the requested host is enough to disrupt this, and even SSL requests send cleartext hosts (sadly).