[dane] domain hijacking

[Wei Chuang <[e-mail]>]

Hi dane folks,

There recently was an article in Wired about how a banking site was domain
hijacked:
https://www.wired.com/2017/04/hackers-hijacked-banks-entire-online-operation/
via a DNS registry account hijacking.  I was wondering if DNSSEC can
protect against such hijackings (and thereby protect DANE records).  My
suspicion is no, DNSSEC can't protect against an attack at the registry
level since a hijacker could publish a new set of consistent records for
the zone including at the parent.  If my suspicion is correct, has there
been thought of re-signing the DS record signed with the older private key
in a way that proves ownership through the key change?  This gets published
at the parent so its visible even if the entire zone gets spoofed.  This,
put another way, would prove publicly continuity of ownership for the
domain.

thanks,
-Wei