Every three months, 7 people fly to a secure ICANN server building and go through an elaborate ceremony to generate a new signing key for DNSSEC. The entire affair appears to be based on politics and not any real security model. If the private keys have not been compromised then no-one else can sign any records, regardless of their control of equipment external to the signing server.
If you are front-loading all of your trust in having the private keys protected, why wouldn't they just ensure that the signing server itself would self-destruct if it was tampered with? You can protect against anyone fiddling with the inputs/outputs by placing 3 of these tamper-proof boxes in different locations world and synchronizing their output. They could be housed in a UN base or a location where the security is jointly handled by countries with semi-adversarial relations (like China and the US) and monitored via a webcam.
Keys would only need to be refreshed if one of the servers goes offline for any reason or if hardware upgrades are needed.