[dns-operations] security-aware stub resolver

[Florian Weimer]

* Patrik Fältström:

> I disagree with you Florian, and agree with Paul. We need any security
> mechanism we have, specifically validation mechanisms. In the DNS
> lookup, in the BGP peering, in the DNS zone transfer, in the
> application that connect a client to a server, ...

We need DNSSEC, but application behavior cannot depend on whether data
from DNS has passed DNSSEC validation or not.

It's like some HTML features being available only if the document has
been downloaded over HTTPS.  It does not make sense.