I'm of more or less the opposite opinion: DNSSEC overall is pretty terrible. DANE is possibly a slight improvement over the existing CA system for some threat

I'm of more or less the opposite opinion: DNSSEC overall is pretty terrible. DANE is possibly a slight improvement over the existing CA system for some threat models, though only very slight. That improvement is frequently zero depending on the chosen threat model, though I've yet to see a real-world scenario where it's worse. DNSSEC is a complicated proposal with basically no adoption that requires widespread adoption to accomplish anything. We've had much better (though still not perfect) ways to improve authority-resolver security for years (DJB's DNSCurve for example). Given this, its only purpose is to make DANE happen. That benefit is way below the cost (again, maybe actual zero benefit depending on your point of view). It may even have a negative benefit by delaying a switch to an actually-good solution once someone figures one out (which nobody has, quite yet).