[ksk-rollover] 答复: 答复: Architectural reconsideration on ICANN's Root Zone KSK rollover

Hi Marc and Robert,

...

There is still risk in this. Many end users are behind NATs.

a large majority of end users are behind IPv4 NATs.

Thanks for pointing out the weakness of this mechanism. I think DNS cookie can help in this scenario. DNS cookie is already standardized and deployed. Davey