&gt; Instead, the X.509 cert. stored in DNS is trusted for TLS purposes simply because it is DNSSEC signed rather than CA issued.<p>And I would see that as a huge mistake. Requiring two layers of verification (DNSSEC + separate CA) is what had I assumed DNSSEC would do.<p>Would that stop the NSA? Probably not, but the person who broke DigiNotar wasn&#x27;t exactly NSA.