Wouldn&#x27;t that require a nation state to:<p>1. Get a signed CA certificate for your domain at gun-point.<p>2. Send a forged DNSSEC record?<p>In which case, it&#x27;s not significantly worse than the current state? And even though we can&#x27;t burn a TLD, we can burn the CA that signed the certificate in the first place?<p>Or is there some magic in DANE that subverts CA verification?