The problem with this is that it requires you to download the blockchain to be secure, or trust a DNSChain server.
Why not make it so the client sends a list of trusted/non-trusted nodes to the DNSChain server, and the DNSChain server returns the DNS records in addition to signatures from all of the trusted/non-trusted nodes. As such, you will have far more ability to trust that the connection is secure as it would require tampering all of the trusted/non-trusted nodes.
For users who don't want to maintain a trusted node list, the browser could by default have a list (like we have a CA list at the moment). If all of the non-trusted nodes disagree with the trusted nodes, then the connection gives a warning message. If most of the non-trusted nodes agree with the trusted nodes, then it is a treated as a secure connection.
It's not a perfect solution, but this is lightweight, scalable etc.
Ofcause, the problem I see is the 48 hour synchronization as the updated DNS record signatures from the trusted node gets sent to the DNSChain server you make the request to. (DNSChain server would have a local DB which gets syncronised as signatures get updated as to provent multiple connections causing the DNSChain server to be slow).
I hope I've made sense. It could be as easy as installing a 'no restart' Firefox Extension, making it very user friendly.
A second problem with Namecoin, is that you can only register .bit domain names. Couldn't nodes check for an uploaded file on a server to 'give' them the Namecoin equivalent? So example.com can upload example.com/verify-namecoin.html and then it gets given a blockchain based example.com domain name.