> If you own and host your own domain, it's probably very easy to have your DNS provider enable DNSSEC for you

It isn't that easy on AWS.

It also generally is not that easy if your domain registrar is not the same as your dns host, because it involves both parties. And some registrers don't have APIs for automatic certificate rotation, so you have to manually rotate the certs periodically.