But it's probably worth remembering that DNSSEC is a PKI over which the USG and its Five Eyes partnership has enormous, outsized influence; they have de facto custody over the most important TLDs on the Internet, a demonstrated willingness to intervene in DNS for policy goals, and, unlike a suborned CA, the TLDs cannot be revoked when the IC abuses them.

"Ceremony" is the right word for IANA's handling of the root zone, which is a McGuffin in the Internet security model; the DNS roots won't be what the IC targets.