The TL;DR of that is:<p>1. DNSSEC uses a lot of 1024-bit RSA signatures (those are relatively weak)
2. You can&#x27;t monitor the certificates that CA&#x27;s issue because anyone issue their own certificates.<p>The first issue seems valid, but fixable. The second is a weird thing to complain about because it is the entire point of DANE!