Did you know? DANE asks a rude but sensible question: why should any random public CA be able to impersonate your domain? RFC 6698 lets a domain publish DNSSEC-signed TLSA records naming the certificate or public key its TLS service should use, and RFC 7671 says those records can augment or even replace trusted public CAs. It is a cleaner trust model: the name owner speaks for the name. #cypherpunk #privacy #dnssec