DNSSEC is so easy to deploy that Cloudflare had to disable it entirely for a significant chunk of all Internet traffic because... the registry operators of .DE were unable to deploy it safely.

This is more than twenty-five years after DNSSEC standardization commenced in earnest (counting from the bis protocol).