Well, technically you only have to trust your DNS registrar minimally if you use DNSSEC and only use your DNS hoster’s servers as slave servers. The registrar could always DoS you of course by not entering new DNSSEC zone signing keys into the parent zone and the hoster by removing your zone from their servers but they can not technically publish any records in your name in that case or prevent individual records from being published (unless those are new and they just keep serving an old version of your zone).