I am often asked why is DNSSEC such a PITA to implement, well, if you asked me this question ten years ago, I'd agree, maybe even five years ago, as then it was better, but still convoluted, so I get why many still are hesitant to use it, it's DNS, and nobody wants to mess up DNS, but Bind, since version 9.16 makes it very easy, it's even at the set and forget stage, so enabling DNSSEC in 2023 is child's play.