lukewarm? takes that i have been wanting to put in a blog post
- hpkp was a good idea and should be revived
- tofu is good if you can make the ux work
- dnssec's pki is too centralized to be relied on. overall, it is even worse than the web pki mostly due to a lack of google via ca/b
- dnssec lacks a transparency system
- dnssec is useless to the end user because everything needs to be authenticated without dns anyway
- dnssec is mostly useless to admins outside of very niche use cases and even then it is redundant
- dane is dangerous due to the aforementioned centralization and nobody should be using it
- that dnssec breaks things and causes availability problems is okay actually
