It actually does DNSSEC for the root domain dnspub.xyz and then I do a hop to an insecure subdomain ‘npub’ which is under my control. All of the DNS resolvers, do the DNSSEC check and are ok to continue to resolve. I plan to add in the RR_SIG record, but that’s a heavy lift in getting it right, but possible and the goal!