Not conceding anything... just pointing out some of the use cases today that are interesting. Another one is most of the email service providers in Germany, wh

Not conceding anything... just pointing out some of the use cases today that are interesting. Another one is most of the email service providers in Germany, where DNSSEC / DANE are being seen as ways to have a more secure email environment. The list can go on... > And one of the ways you suggest it could help is to allow clients to override TLS certificates and instead trust the government-controlled DNS. :-) Where did I say override, Thomas? You can, if you wish, use a different trust anchor than the current (broken) CA system, but the beauty of DANE is that it gives you a way to add another layer of trust to existing systems. So you can use a CA-issued TLS cert and put a fingerprint in a TLSA record as an added check during a SMTP transaction. You could also check certs with CT... and if it were HTTP you could do pinning as well. As many layers as you want!