There seems to be this mistaken belief that DNSSEC&#x2F;DANE are intended to replace CAs. There is no such idea.<p>I wrote about this recently if you&#x27;re interested.
<a href="http:&#x2F;&#x2F;metafarce.com&#x2F;adventures-in-dane&#x2F;" rel="nofollow">http:&#x2F;&#x2F;metafarce.com&#x2F;adventures-in-dane&#x2F;</a><p>&quot;..the purpose of DANE is not to do away with the CA system. It is to provide another chain of trust based on the DNS hierarchy.&quot;