"Trusting all the existing CAs" is literally the status quo, though, right? So whatever it is you are proposing as a replacement needs to be strictly better th

"Trusting all the existing CAs" is literally the status quo, though, right? So whatever it is you are proposing as a replacement needs to be strictly better than that. I've made my case for how DANE is better, but what exactly are you proposing as an alternative? Is it just "trusting all the existing CAs, and distrusting them a few months after they have been caught (using CT) breaking the rules"? You earlier argued that the strength of the CA system is that they "can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers", but that just sounds like you're saying "the good thing about the CA system is that it keeps failing, and our repeated belated steps to punish malfeasance do not work as a deterrent". Again, I look forward to reading what you propose instead of the CA system and DANE.