That's saying less than it appears to. What the RFC is saying is that CAs should be validating DNSSEC where it exists. It was written at a time when CAs didn't uniformly validate DNSSEC at all (because DNSSEC causes outages and pisses off customers). Even I think CAs should validate DNSSEC where it exists! It is not a general recommendation that everyone sign their zones, though.