>In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. They can also do this in a non DNSSEC/DANE world, at the

>In a DNSSEC/DANE world, the Libyan government can successfully publish a fake certificate for BIT.LY. They can also do this in a non DNSSEC/DANE world, at the crudest lowest level by hijacking the domain, and then buying a new cert and clicking the confirmation email.