The metric M7 tracks the usage of DNSSEC in TLD. There is an interesting difference between GTLD and CCTLD for this metric. The contract of GTLD with ICANN requires them to deploy DNSSEC, and thus we can expect values close to 100%. CC TLD do not have any such oblication, and the deployment of DNSSEC reflects the initiative of the CC TLD operators. We thus track the DNSSEC deployment in TLD in two ways:
The metric is computed by parsing the root zone. We download a copy of the root zone every month, and check for each TLD in the zone whether a Delegation Signer (DS) Resource Record is present. If the DS record is present, we mark the TLD as deploying DNSSEC.
The current values of the metrics is available here.