denic is the single source of truth for zones under .de.

The only problem with DNSSEC here is that it's complex.

A complex thing where making a mistake makes your domains drop off the internet seems like a pretty big "only problem".

There is no more complexity other than what is inherent to the task.