I now get that the DNS no-change part. Was focused on the latter distinctions between: - incomplete mTLS and lack of DNSSEC implementation (found in all web b

I now get that the DNS no-change part. Was focused on the latter distinctions between: - incomplete mTLS and lack of DNSSEC implementation (found in all web browsers) - proper two-way mTLS with PKI validation of CA chain whose DNS CAA record is verified as properly protected by DNSSEC. The latter distinction gets your data through a BGP hijack safely from any MitM; former one, not so much.