Don't stress too much about the cert thing, everyone has DNSSEC on their domains right? And people use a validating resolver? Oh! They don't? Right. Well. Ok.