Comment by Avamander

> have there been any reported cases of law enforcement changing DNSSEC (e.g. adding a DS record)?

It's not like anybody is watching or using DNSSEC like that. Also at best you might be able to detect a change but it won't prevent the attack and neither will it leave a long-term mark like CT would.