Look, I'm not saying DNSSEC is perfect. I don't like it. I just don't see a practical alternative to solving downgrade attacks in the face of such a plethora of crappy Internet protocols.
When they do that, maybe I'll re-evaluate DNSSEC. In the meantime: the more people who deploy DNSSEC, the harder it gets to fix the broken crypto, so we should just stop.
The choice of crappy ECC isn't really a technical problem, but a political one. The IETF are wrangling as we speak about the introduction of safe curves in to TLS. djb is lamenting the process.
Btw, I'm all for radical overhaul of the Internet stack, from TCP up, but history tells us radical changes struggle to see adoption. DNSSEC is here and it's easy to deploy (really, it is). It sucks, but it has momentum now and it isn't going away. Killing it without a political push behind a better full-stack solution is just a step backwards.
You're probably correct however in that adopting DNSSEC will reduce the chances of a better alternative making headway, just like adopting HTTP/2 is going to further reduce the chances of SCTP (or something better) adoption ever picking up.
Second, there is no DNSSEC equivalent to HSTS. Saying that there could be one is not a very compelling argument. There could be a lot of things.
You're also wrong about the "technical" versus "political" nature of DNSSEC's ECC problem. The technical problem with DNSSEC ECC is that every additional DNSSEC resolver that gets deployed without a modern ECC signature record type makes it harder to roll out that record type in the future. Once again: even the (bad) ECC that DNSSEC already supports breaks fully 1/3rd of the DNSSEC installed base. No part of my argument involves Daniel Bernstein's opinion of the CFRG.
I'm not sure what the analog between HTTP/2 and SCTP is. SCTP is a transport protocol. It's something you'd run HTTP/2 on top of.
In any case: DNSSEC is shitty now, makes the Internet shittier, and actually has the interesting property of getting shittier the more people deploy it. Virtually nobody uses it. If DNSSEC stopped functioning today, no Fortune-500 company would notice. I'm mystified by this notion that we're past some "point of no return" with DNSSEC. We clearly are not.
