> Especially given the cert is basically now a requirement to get onboard with http2 at all. That was a proposal before the specs of HTTP/2 were official, it's

> Especially given the cert is basically now a requirement to get onboard with http2 at all. That was a proposal before the specs of HTTP/2 were official, it's not a requirement anymore. > I truly appreciate the heroic efforts of let's encrypt, however that seems to be an annoying middle step before DNSSEC. I don't think that DNSSEC is a great idea. Chrome supported DANE for a while, but they removed the support for it. TLS + HPKP + HSTS is working great, DNSSEC don't improve a lot when we would add it.