[tptacek]

It's explicitly not the point of DNSSEC, which has for most of its entire existence been designed to be run as a server-to-server protocol, with stub resolvers trusting their upstream DNS servers.

I agree with you, though. It's utterly pointless.

[jcalvinowens]

Not true, RFC4035 says all security aware resolvers SHOULD verify the signatures. It's far from pointless when actually implemented. Don't dismiss a whole protocol just because some historical implementations have been half assed.

[tptacek]

The RFC uses "security-aware" to set them apart from ordinary resolvers, which are what every mainstream resolver uses.