Getting the reverse delegation for your subnet is simple. What about deploying DNSSec for the reverse zones and allowing secure delegations? I know, there are some operational challenges (like key rollover, resigning etc.). But I'm certain it's doable. Okay, I see that we'll need a chain of trust in the end. I know the argument of the not signed root. But RIPE is signing ... most likely the PoPs do not yet have the infrastructure in place. What else is stopping you and us from deploying it? [Yes, my zones are signed]