mschae

As nice as DANE is, it just shifts the burden of trust to your DNS provider. Like if you hop on Wi-Fi at a coffee shop, said network can simply MITM connections and supply their own certs via re-writing the DNS.

It can’t, because DANE requires the use of DNSSEC. Unfortunately, there are still so many domains that do not have a proper DNSSEC configuration… so it’s unlikely to work out well in practice, anyway.

edit: not to mention the DNS is centralized too. It’s federated, at least (in the original sense of the word, not the way it is used on the fediverse), but ICANN is still the only central authority at the end.

Something like DANE, maybe? Only the websites actually using the compromised certificates would be compromised.

but I assume that it sets legal precedent for all.

Other courts might look at it for inspiration, but since Germany has a civil law system (as opposed to the common law system that is usual in English-speaking countries), prior rulings do not really have as much significance as “legal precedent” here.