Because it requires DNSSEC, and the impact of misconfiguring DNSSEC is unnecessarily high just to validate a certificate. Something like DANE that didn't requir

Because it requires DNSSEC, and the impact of misconfiguring DNSSEC is unnecessarily high just to validate a certificate. Something like DANE that didn't require DNSSEC would work great I think