But how do you make DNS secure without CAs?

You just have one big one on the root.

(Half joking).

Better to trust 1 organisation than trust 100.

Is that a reference to the Root Key of DNSSEC?