Comment by eqvinox

I'm not connecting at all on this discussion because I don't understand what entity/role in DNS/DANE is the equivalent to eMudrah that is to be distrusted and can't / has to deal with compromised key material. It could be either the registrar or the TLD operator. The former you can switch to another one. The latter just makes the entire TLD unusable no matter how you spin it and whether you use DANE or not. Is there some third role you're considering here?