DNSSEC is necessary like GPG signatures are necessary; though also there are DoH/DoT/DoQ and HTTPS.

Google doesn't have DNSSEC because they've chosen not to implement it, FWIU.

/? DNSSEC deployment statistics: https://www.google.com/search?q=dnssec+deployment+statistics...

If not DNSSEC, then they should push another standard for signing DNS records (so that they are signed at rest (and encrypted in motion)).

Do DS records or multiple TLDs and x.509 certs prevent load balancing?

Were there multiple keys for a reason?