I wondered if DNSSEC would be vulnerable to (remote) timing attacks, unlike TLS, signatures don't have to be recalculated each time. So how would you be able to exploit timing information in the first place?
Also see this quote:
Can’t DNSSEC support Elliptic Curve as well as RSA?
The NIST P- curves are most probably not backdoored, despite their reliance on a magic number generated at NSA. But their curve structure is old and error-prone. They are difficult to implement in “constant time”, to stop attackers from measuring the time operations take to learn secret keys.