denic is the single source of truth for zones under .de.

The only problem with DNSSEC here is that it's complex.

A complex thing where making a mistake makes your domains drop off the internet seems like a pretty big "only problem".