[Avamander]

> but if we rely on DNSSEC we can just use DANE/TLSA and don't need the mess of CA/PKI

DNSSEC is PKI. We don't want to rely on it because it's significantly worse than WebPKI.

[jesprenj]

I think it is orders of magnitude better.