I have no idea whether there's any basis for concern, but I'm sure we have some DNSSEC experts here on HN. Comments?
The result will be chaos.
It is pushing off the "do you trust (Versign+USDoJ | greatfirewall.cn) to give you the legitimate answer to your .com query" problem. Which is the kind of problem that the Internet is good at routing around but would be bad for it to do so.
E.g., users will (at best) change to alternative DNS systems or (at worst) toss out this hierarchical authority naming concept entirely. Consider how many users simply wouldn't notice if Google started returning IP addresses or proxy names for search results. Or maybe they set up an alternate with their own naming scheme for Chrome, Android, ChromeOS, and everyone with their search bar. (Oh wait, I just Googled it and they already did that and I didn't notice http://www.infoworld.com/t/dns/google-launches-alternative-d... )
If Google does it, then Microsoft must too. And Amazon, and The Pirate Bay and so then we need a protocol for deciding which DNS system the client will use on a per-request basis, and civil-rights-disrespecting governments try to sabotage that too and round-we-go the Internet we know and love is circling the drain.
It is a vastly simpler, tactical solution to the DNS "security problem" (I'm a skeptic about the long term importance of this problem too).
Just another pay-per-install malware module?
Hard for AV to detect the settings are wrong?
http://www.eweek.com/c/a/Security/Researchers-Discover-Link-...
The TOR .onion URL scheme is closer to what you're talking about, I think. It actually does present an alternate domain that isn't available outside of TOR.
.onion is an alternate root. There's an interesting page at http://en.wikipedia.org/wiki/Alternative_DNS_root giving the history of them.
A friend was using OpenDNS for a while, until we figured out they were MitMing google.com and intercepting his queries. I wonder if they still do that.
Of course, ICANN has decided to begin selling TLDs for a $200K application fee. There goes the neighborhood.
In essence, any measure that involves changing the contents of the DNS (by filtering etc.) is indistinguishable from a man-in-the-middle attack which is what DNSSEC is trying to stop.