this story will evolve as the http ecosystem evolves - but that's part of the point. wrt coalescing/origin/secondary-certificates its a powerful notion to cons

this story will evolve as the http ecosystem evolves - but that's part of the point. wrt coalescing/origin/secondary-certificates its a powerful notion to consider your recursive resolver's ability to serve other http traffic on the same connection. That has implications for anti-censorship and traffic analysis. Additionally the ability to push DNS information that it anticipates you will need outside the real time moment of an additional record has some interesting properties. DoH right now is limited to the recursive resolver case. But it does lay the groundwork for other http servers being able to publish some DNS information - that's something that needs some deep security based thinking before it can be allowed, but this is a step towards being compatible with that design. wrt caching - some apps might want a custom dns cache (as firefox does), but some may simply use an existing http cache for that purpose without having to invent a dns cache. leveraging code is good. There are lots of other little things like that which http brings for free - media type negotiation, proxying, authentication, etc..