@digicert don't appear to be using DNSSEC So, one DNS poisoning, and Apple users can't install updates/software. Of course, people often make mistakes with DNSSEC - if they had it and messed up a key, then @apple users would get a similar denial of service.