[kyrias]

No, with DANE nothing rests on CA's. With DANE domain owners store their keys in the DNS, and the DNS records are signed with DNSSEC