Rotating (and removing old keys from DNS) without publishing the private keys would already make it really hard.

For proving an old signature you'd lack an _authentic_ source for the signing public key that could only really be a dump of the historic DNS trace with all DNSSEC signatures (i.e. gmail does not use it).