Everyone blames DNS. Almost no one can tell. This plays the whole thing: a query mints a one-time nonce, reaches the genuine authority, and comes back with a signature you can verify — then catches a tampered path in the act. Synthetic data, runs entirely in your browser.