It doesn&#x27;t really matter. Most people are only getting their CA certs through domain validation anyhow, so you&#x27;re already at the mercy of registrars and TLDs.<p>DANE actually reduces the people you need to trust. Hell, some CAs will issue a cert for a domain to anyone who can write to the docroot on the webserver it points to. Grabbing one before a malicious entity and deploying HSTS and HPKP is your only weak defence.