How does having a new super-CA controlled by the NSA impede key pinning and certificate transparency?<p>I agree that CAs + DANE is just as shitty or shitter than CAs.<p>But:<p>a) In the event DANE replaced the CA system, one super-CA controlled by the NSA is better than 300 CAs essentially controlled by 50 different governments including the NSA.<p>b) Nobody&#x27;s making you use DANE. Signed DNS records are an improvement over the status quo regardless of what you think of tying TLS to it.