Closed Nuhvi closed 6 months ago
After some conversations, DNSSEC doesn't seem viable since it DNSSEC enabled clients won't actually recognize Pkarr TLDs as sovereign keys, and will expect a non-existent certificate chain from ICANN.
Alternatively, we could put the signature in the additional
section, even though that will include some fiddling, and will need some speccing.
While relay recommendations are interesting, I decided that they are mostly useful for high frequency updates, and while that is needed for many applications, it should be clear that it is not within the purposes of neither Pkarr or DNS in general. Thus the cost of complexity of relay recommendations isn't only not justified, it is probably harmful to the clear communication of goals and non-goals of Pkarr.
If the DNS packet provided by the user have enough remaining space, we could automatically add: