There is a better way than CT: DANE, with query name minimization to prevent MITMing of some domains (as opposed to none or all) by a malicious or compromised . or TLD.
DANE means you get a real PKI with real name constraints, unlike WebPKI.
DANE stapling can reduce latency, but doing DANE w/ qname minimization for most of the domainname being resolved has the property that you get to make life really hard for a malicious or compromised . or TLD. You get to cache a lot of results, so using DANE stapling for the stem of the domainname should still reduce latency a fair bit.
With DNS over TLS or HTTPS we're seeing that resolvers are willing to use TCP, which is one answer to the DNS amplification attack concern.
DANE means you get a real PKI with real name constraints, unlike WebPKI.
DANE stapling can reduce latency, but doing DANE w/ qname minimization for most of the domainname being resolved has the property that you get to make life really hard for a malicious or compromised . or TLD. You get to cache a lot of results, so using DANE stapling for the stem of the domainname should still reduce latency a fair bit.
With DNS over TLS or HTTPS we're seeing that resolvers are willing to use TCP, which is one answer to the DNS amplification attack concern.