I mean when you are adding a new domain, CF can clearly tell if a domain already has dnssec on or not. Seems like something that should raise a warning to the user.
Source: me, having lost access to my domain for 4 days for reasons that are not yet fully clear to me.