> You responded to a 40-word comment just there.
And if it was the only one it wouldn't even deserve a comment. But it isn't because basically any mention of DNSSEC triggers your insistence that it can't work. All the stuff you've commended which didn't work went unmourned, but DNSSEC you're really animated about.
> The Internet has worked just fine without a centralized PKI for DNS name signatures for decades.
The Internet likewise worked "just fine" without a secure shell for decades. Tatu shipped his ssh command in 1995. Before that, and indeed for a year or five after as it was popularized, it was routine to rlogin to remote Unix machines - the user's unencrypted password was just sent over the wire like it's no big deal. But I'm going to guess that Thomas the Security Guy doesn't think rlogin is good enough in 2026 does he?
> Key pinning isn't a thing anymore because we have Certificate Transparency
Mozilla removed Key Pinning in Firefox 78. They added CT checks in Firefox 135. Hopefully it's pretty obvious to you that 135 was not before 78. HTTP Key Pinning was a fiasco. CT is to some extent coincidental timing rather than somehow a planned replacement and doesn't even attempt to address the same problems, because many of them were mirages.
> The gun, in the case of the domain name system, points the other direction.
Not at all. Browser vendor choices impact on the DNS and not vice versa. It's been that way since the beginning. The browsers don't look for the modern HTTP service record in DNS, so just make an A record for www to create a web server. And when they did finally decide to use HTTPS records they decided how to use them and when to use them, there was no way for DNS to impose that.
For the overwhelming majority of person-hours (or even Unix nerd person-hours) spent on the Internet we have had cryptographically secured remote shells.
Over all those hours, from the dawn of time until now, we have not had a centralized DNS PKI. The reason we haven't is that we don't need one. The way you know that is that virtually nothing has been compromised owing to a lack of it.
I honestly don't care what you think of key pinning. By 2016 I was advising clients against doing it. My point about your "pinning" timeline thing is that you sort of conveniently neglected to mention Certificate Transparency, pretending as if, when key pinning broke down, everyone just ignored the underlying problem. Obviously, no.