I don't know a lot about DNSSEC but wouldn't this allow them to do man in the middle type attacks on pretty much anyone?

And because the DNS responses would be signed with valid trusted certificates, more trust would be put in the responses making them less likely to be double checked.

Now all they need to do is serve a secret order for Root Keys on US based Certificate Authorities (if they haven't already) and they can easily listen in on pretty much any internet SSL traffic without us being any the wiser. The only time they would have problem is in b2b type situations where both ends validate certificates that have previously been exchanged.