The registry operator for .com has all the privileges (regarding certificate generation) over all .com domains
As such, DANE would not add more issue here;
DNSSEC is easy to deploy (of course, you need to know your work, which is rarely the case). Legacy-first mindset is not really productive;
That's is correct, but on the other hand, incorrect: as a .com registry, I can:
- fake the CAA records
- fake the DCV records
- make any CA sign any certificates
People would not even notice because, if a given website is commonly signed by LE, I can trick LE into signing a new certificate for me. The transparency logs would just show that LE signed a certificate, as usual. Again: registries have already all the power in the world (it is a good thing: not the current issue :) )
As such, DANE would not add more issue here;
DNSSEC is easy to deploy (of course, you need to know your work, which is rarely the case). Legacy-first mindset is not really productive;
That's is correct, but on the other hand, incorrect: as a .com registry, I can:
People would not even notice because, if a given website is commonly signed by LE, I can trick LE into signing a new certificate for me. The transparency logs would just show that LE signed a certificate, as usual. Again: registries have already all the power in the world (it is a good thing: not the current issue :) )