Compare to the key signing behind the dnnsec root.

Personally, I dislike the opacity of webpki roots. I think we should have made browsers ship with far fewer. Like two, Max.