reposting a comment:<p>What do you think would happen under a DNSSEC-DANE TLS world if that started being detected via key pinning&#x2F;CT ?<p>There is just no way the NSA is going to risk it except in very very specific circumstances they can easily control, (exactly the same situation as HPKP) because, they too will be forever burned just like an ssl CA would, except now they cant just switch to one of hundreds of other CAs, they have burned the root keys to a tld. This will be obvious, this will be screamed about from the rooftops, the key will be rotated + a ton greater scrutiny applied to the process.<p>Its not like browsers and other people pinning certs are just going to shrug their shoulders and say &quot;aw shucks, i guess we wont worry about it&quot;