[Avamander]

With the CT system I can monitor the CA's issuance, with DNSSEC I can't retroactively monitor if someone has changed the DANE keys and intercepted traffic.

[dane-pgp]

True, DNSSEC Transparency is not as developed a technology as Certificate Transparency. There has been experimental deployment of such a system[0] but to give higher assurance there is a small addition to the DNS data that needs to be adopted first[1], which is still going through the IETF process.

[0] https://twitter.com/ln4711/status/754516056878772224

[1] https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-deleg...

[tptacek]

Certificate Transparency, by contrast, exists.

[dane-pgp]

There was a time when Certificate Transparency didn't exist, and people didn't propose throwing away the web PKI because of that.

[Avamander]

Yeah, because Web PKI existed, DNSSEC has yet to gather any meaningful good deployment. It's not hard to throw away something that doesn't exist :P