To expand on this. If you store your public SSH key in DNSSEC, I'm assuming that the use-case is either:

1. Pull the public key from DNS to add to ~/.ssh/authorized_keys

2. Implement an sshd runtime that checks the DNS record rather then (or in addition to) ~/.ssh/authorized_keys

Sure, it's "just" the public key so you're not providing the private key to the world-at-large, but if the NSA controls DNSSEC, then they can change the public key to one that is paired with a private key that they control. Now they have access to all systems that the public key could access. This is basically adding DNSSEC as an attack vector to your ~/.ssh/authorized_keys file, which seems like a bad idea.

Please correct me if I'm missing something about how DNSSEC and SSH keys would be used together.