> but if we rely on DNSSEC we can just use DANE/TLSA and don't need the mess of CA/PKI

DNSSEC is PKI. We don't want to rely on it because it's significantly worse than WebPKI.