> The best reason DANE isn't deployed is that it vests keying authority with organizations that can't be revoked. Speaking of TLDs, there are still some TLDs t

> The best reason DANE isn't deployed is that it vests keying authority with organizations that can't be revoked. Speaking of TLDs, there are still some TLDs that don't support DNSSEC at all, meaning that some that do want to use DNSSEC/DANE (usually for certificate pinning for MX systems) have migrated to TLDs that do. Also IIRC DANE can be used in a "verify that this is the key but also checked if it's signed by a trustworthy CA", but at this point why bother?