Also if the certificate is published in the DNS, and available through DANE (using DNSSEC)? That would be very disappointing.