[dns-operations] Implementation of negative trust anchors?

[Randy Bush]

> I think we need to acknowledge that there will always be signing
> problems

< from a conversation with a friend wiser than i >

the problem is that we are going through a deployment phase where there
is little penalty for sloppy server ops because so few are validating.

patching over this to be more tolerant of sloppy server ops is going in
the wrong direction.  we need to think about how to make good server ops
the easy path:
  o less breakage prone protocols
  o less breakage prone implementations
  o easing fast repair if breakage is known
  o detecting and reporting more aggressively
  o blah blah blah

i.e. put that gun back in your hand

randy