That is true, however it could be used for CA verification also, could it not? Edit: RFC 6844 very unambigously states that it can be used for additional verif

That is true, however it could be used for CA verification also, could it not? Edit: RFC 6844 very unambigously states that it can be used for additional verification: CAA records MAY be used by Certificate Evaluators as a possible indicator of a security policy violation. Such use SHOULD take account of the possibility that published CAA records changed between the time a certificate was issued and the time at which the certificate was observed by the Certificate Evaluator.