Comment by giovannibajo1

The only problem with DANE is that it doesn't protect from NSA. You are simply moving trust from CAs to your TLD owner. Whoever controls your TLD (and whoever can subpoena them) is able to change your zone file without you realizing it.