&gt; Especially given the cert is basically now a requirement to get onboard with http2 at all.<p>That was a proposal before the specs of HTTP&#x2F;2 were official, it&#x27;s not a requirement anymore.<p>&gt; I truly appreciate the heroic efforts of let&#x27;s encrypt, however that seems to be an annoying middle step before DNSSEC.<p>I don&#x27;t think that DNSSEC is a great idea. Chrome supported DANE for a while, but they removed the support for it.<p>TLS + HPKP + HSTS is working great, DNSSEC don&#x27;t improve a lot when we would add it.