I know a lot of people seem to think that, but that&#x27;s just not right.<p>You can pin a certificate with X.509 CA TLS, and you can theoretically pin a certificate against DNSSEC&#x2F;DANE (no browser does and it&#x27;s unlikely they ever will; browsers flirted with DNSSEC a few years ago and that code has been withdrawn).<p>But when you pin an X.509 CA cert, you can also punish CAs that issue fraudulent CAs that break pins. This has already happened several times.<p>When you break a DNSSEC&#x2F;DANE pin, you have <i>no recourse</i>. Everyone relies on the same .COM keys.