Forged DNSSEC replies are inherently more public than forged TLS certificates, anybody can log the results and publish them. And by doing so, the world would h

Forged DNSSEC replies are inherently more public than forged TLS certificates, anybody can log the results and publish them. And by doing so, the world would have evidence that somebody in that trust chain for that TLD has been lying. For TLS, that could be any CA in the world, which means that the number of single points of failure for services on DNSSEC is waaay lower. Because with DNSSEC you at least can chose who has the capability of forging results, with TLS alone that's all of the CA:s. And why couldn't one combine the approaches anyway, using DNSSEC+DANE with certificate pinning? How would that possibly reduce security vs using standard DNS?