DANE has its own issues though: by itself, even if you're using DNSSEC with it (as you ought to be), you're essentially shifting trust from CAs to registry oper

DANE has its own issues though: by itself, even if you're using DNSSEC with it (as you ought to be), you're essentially shifting trust from CAs to registry operators, your DNS service provider, and whoever operates the root zone.