That being said, I have been thinking of a DNSSEC2 which would use online signing only to make the protocol simpler for example. And a replacement for DANE that

That being said, I have been thinking of a DNSSEC2 which would use online signing only to make the protocol simpler for example. And a replacement for DANE that focuses on pinning CAs would also be a good idea.