diff --git a/macx-resources/Brewfile b/macx-resources/Brewfile
index ca72ee5..cf6950f 100644
--- a/macx-resources/Brewfile
+++ b/macx-resources/Brewfile
@@ -1,3 +1,7 @@
+##############################
+# zotan's bootstrap Brewfile #
+##############################
+
 # taps
 tap "homebrew/bundle"
 tap "homebrew/cask"
@@ -9,144 +13,145 @@ tap "osx-cross/arm"
 tap "osx-cross/avr"
 tap "qmk/qmk"
 
-# system tools
+# cli tools
+## basic
 brew "jq"
+brew "bat"
+brew "git"
 brew "mtr"
-brew "mpc"
 brew "wget"
 brew "htop"
 brew "nano"
+brew "nmap"
 brew "ldns" # provides drill
 brew "whois"
 brew "watch"
+brew "stress"
 brew "iperf3"
-brew "ncmpcpp"
+brew "ripgrep"
 brew "openssh"
-brew "topgrade"
-brew "media-info"
 brew "iproute2mac"
+
+## common
+brew "mpc"
+brew "aria2"
+brew "xdelta"
+brew "ffmpeg"
+brew "pandoc"
+brew "yt-dlp"
+brew "ncmpcpp"
+brew "sshuttle"
+brew "neofetch"
+brew "topgrade"
+brew "qrencode"
+brew "media-info"
+brew "imagemagick"
 brew "pinentry-mac"
+brew "smartmontools"
 brew "wireguard-tools"
 
-# dev tools
+## development
+brew "gcc"
+brew "glib"
+brew "cmake"
+brew "ninja"
+brew "sqlite"
 brew "dotnet"
+brew "python"
+brew "git-lfs"
+brew "uncrustify"
+brew "platformio"
+brew "qmk/qmk/qmk"
+brew "rustup-init"
+brew "rust-analyzer"
 
-# basic desktop apps
+# desktop apps
+## basic / UX improvements
 cask "iterm2"
-cask "element"
-cask "telegram"
+cask "alfred"
+cask "itsycal"
+cask "contexts"
+cask "topnotch"
+cask "bartender"
 cask "rectangle"
 cask "sublime-text"
-
-# desktop apps - utilities
-cask "mp3tag"
-
-
-# libraries
-## TODO / FIXME
-
-brew "gettext"
-brew "sqlite"
-brew "aria2"
-brew "icu4c"
-brew "boost"
-brew "bat"
-brew "glib"
-brew "python@3.9"
-brew "cmake"
-brew "unbound"
-brew "harfbuzz"
-brew "tesseract"
-brew "ffmpeg"
-brew "gcc"
-brew "git"
-brew "git-lfs"
-brew "libgpg-error"
-brew "libgcrypt"
-brew "gperf"
-brew "libheif"
-brew "imagemagick"
-brew "libraqm"
-brew "mas"
-brew "taglib"
-brew "neofetch"
-brew "ninja"
-brew "nmap"
-brew "openssl@3"
-brew "pandoc"
-brew "tcl-tk"
-brew "platformio"
-brew "protobuf"
-brew "pyenv"
-brew "qrencode"
-brew "ripgrep"
-brew "rust-analyzer"
-brew "rustup-init"
-brew "smartmontools"
-brew "sshuttle"
-brew "stress"
-brew "syncthing", restart_service: true
-brew "uncrustify"
-brew "xdelta"
-brew "yt-dlp"
-brew "qmk/qmk/qmk"
-
-cask "alfred"
-cask "amorphousdiskmark"
-cask "anydesk"
-cask "audacity"
-cask "avibrazil-rdm"
-cask "avidemux"
-cask "balenaetcher"
-cask "bartender"
-cask "calibre"
-cask "carbon-copy-cloner"
-cask "contexts"
-cask "daisydisk"
-cask "dash"
-cask "discord"
-cask "firefox"
-cask "fl-studio"
-cask "gimp"
 cask "google-chrome"
-cask "google-drive"
-cask "gpg-suite"
-cask "hex-fiend"
-cask "iina"
-cask "inkscape"
-cask "itch"
-cask "itsycal"
-cask "jetbrains-toolbox"
-cask "little-snitch"
-cask "maciasl"
-cask "mactex-no-gui"
-cask "melonds"
+
+## messengers
 cask "nheko"
-cask "obs"
+cask "signal"
+cask "discord"
+cask "element"
+cask "telegram"
+
+## documents and synchronization
 cask "obsidian"
-cask "plistedit-pro"
+cask "syncthing"
+cask "google-drive"
+cask "mactex-no-gui"
+
+## data transfer and encryption
+cask "transmit"
+cask "gpg-suite"
+cask "balenaetcher"
+
+## development
+cask "dash"
+cask "hex-fiend"
+cask "jetbrains-toolbox"
+
+## media
+cask "obs"
+cask "mpv"
+cask "iina"
+cask "gimp"
+cask "mp3tag"
+cask "calibre"
+cask "spotify"
+cask "audacity"
+cask "avidemux"
+cask "inkscape"
+cask "fl-studio"
+cask "affinity-photo"
+
+## gaming
+cask "itch"
+cask "steam"
+cask "melonds"
 cask "pokemon-reborn"
 cask "pokemon-showdown"
 cask "pokemon-trading-card-game-online"
-cask "setapp"
-cask "signal"
-cask "spotify"
-cask "steam"
-cask "telegram-desktop" # for testing
-cask "topnotch"
-cask "transmit"
+
+## system
+cask "utm"
+cask "maciasl"
+cask "daisydisk"
+cask "little-snitch"
+cask "plistedit-pro"
+cask "amorphousdiskmark"
+cask "carbon-copy-cloner"
+
+## networking
 cask "viscosity"
 cask "wireshark"
-cask "affinity-photo"
-cask "utm"
 
-mas "Amphetamine", id: 937984704
-mas "Boop", id: 1518425043
-mas "Developer", id: 640199958
-mas "ICE Buddy", id: 1595947689
-mas "Key Codes", id: 414568915
+## 3rd party app stores
+cask "setapp"
+
+## secondary software for testing and debugging
+cask "firefox"
+cask "telegram-desktop"
+
+# App Store
+## cli so we can actually manage these
+brew "mas"
+
+## iLife
 mas "Keynote", id: 409183694
-mas "Navigator", id: 1590354537
 mas "Numbers", id: 409203825
 mas "Pages", id: 409201541
-mas "Reeder", id: 1529448980
+
+## Other
+mas "Amphetamine", id: 937984704
+mas "Navigator", id: 1590354537
+mas "Reeder", id: 1529448980
\ No newline at end of file
diff --git a/macx-resources/dnssec-root.key b/macx-resources/dnssec-root.key
new file mode 100644
index 0000000..e696b32
--- /dev/null
+++ b/macx-resources/dnssec-root.key
@@ -0,0 +1,2 @@
+. IN DNSKEY 256 3 8 AwEAAbPwrxwtOMENWvblQbUFwBllR7ZtXsu9rg/LdyklKs9gU2GQTeOc59XjhuAPZ4WrT09z6YPL+vzIIJqnG3Hiru7hFUQ4pH0qsLNxrsuZrZYmXAKoVa9SXL1Ap0LygwrIugEk1G4v7Rk/Alt1jLUIE+ZymGtSEhIuGQdXrEmj3ffzXY13H42X4Ja3vJTn/WIQOXY7vwHXGDypSh9j0Tt0hknF1yVJCrIpfkhFWihMKNdMzMprD4bV+PDLRA5YSn3OPIeUnRn9qBUCN11LXQKb+W3Jg+m/5xQRQJzJ/qXgDh1+aN+Mc9AstP29Y/ZLFmF6cKtL2zoUMN5I5QymeSkJJzc=
+. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
diff --git a/macx.sh b/macx.sh
index e248349..5799026 100644
--- a/macx.sh
+++ b/macx.sh
@@ -1,5 +1,12 @@
 #!/bin/bash
 
+clear
+echo "macx.sh by ~zotan, bootstrapping system..."
+echo
+echo "--- Installing Rosetta 2 ---"
+/usr/sbin/softwareupdate --install-rosetta --agree-to-license
+
+echo
 echo "--- Installing homebrew ---"
 set -e
 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
@@ -7,16 +14,20 @@ set -e
 eval "$(/opt/homebrew/bin/brew shellenv)"
 set +e
 
+echo
 echo "--- Downloading Brewfile ---"
-mkdir -P ~/Projects
+mkdir -p ~/Projects
 git clone https://git.ztn.sh/zotan/os-install-scripts ~/Projects/os-install-scripts
 
+echo
 echo "--- Linking to system Brewfile ---"
 ln -s ~/Projects/os-install-scripts/macx-resources/Brewfile ~/.Brewfile
 
+echo
 echo "--- Running brew bundle ---"
 brew bundle --global
 
+echo
 echo "--- Running postinstall steps ---"
 echo "Configuring pinentry-mac"
 mkdir -p ~/.gnupg
@@ -34,17 +45,18 @@ defaults -currentHost write -g AppleFontSmoothing -int 0
 echo "Fixing dotnet symlink"
 sudo ln -s /opt/homebrew/opt/dotnet/libexec /usr/local/share/dotnet
 
+echo "Installing DNSSEC root anchor for ldns and drill"
+mkdir -p /opt/homebrew/opt/ldns/etc/unbound
+cp ~/Projects/macx-resources/dnssec-root.key /opt/homebrew/opt/ldns/etc/unbound/root.key
 
 ####
 echo
-echo "iOS Applications not installed automatically: bunq"
-echo "Please fetch them from the App Store manually."
-echo
-echo "Setapp Applications not installed automatically: TablePlus, Jump Desktop, RapidAPI, WiFi Explorer, Archiver, Proxyman"
-echo "Please fetch them from Setapp manually."
-echo
-echo "Other Applications not installed automatically: Capture One, u-he hive, Arturia Software Center"
-echo "Please download and install them manually."
-echo
-echo
 echo "All done. Please reboot to make sure everything is applied."
+echo
+echo
+echo
+echo "iOS applications not installed automatically:    bunq"
+echo "Other applications not installed automatically:  Amphetamine Enhancer, Capture One, u-he hive, Arturia Software Center"
+echo "Setapp applications not installed automatically: TablePlus, Jump Desktop, RapidAPI, WiFi Explorer, Archiver, Proxyman"
+echo
+echo "Please download and install them manually."