[tptacek]

If the goal is to have DNSSEC replace the CAs, then you need DANE, and for DANE to work, browsers have to support it.

[_-___________-_]

That can indeed be a goal, but DNSSEC is useful even without DANE.

[tptacek]

(a) No it can't be, and (b) that's not what this thread was about.