Sounds broken

If DNSSEC requires a single root, then is it not broken by design. It sounds like the system has a single point of failure. Could each country not maintain its own roots, securing the domains for said country.

It sounds like a typical IETF plan, poorly thought out, full of implementation issues and general pain.