And the CA that issues the cert will be flamed and possibly removed from Chrome/Firefox.
(Edit: If they are caught.)
Why would they be removed? If the CA correctly follows all of their procedures and approves a domain-validated cert, why punish them for approving what is a legitimate request?
If the CA is coerced into issuing a cert, however, I agree with you.
You’re right. I misunderstood the scenario we were discussing.
So isn't that a criticism of domain-validated certificates? This is a serious question. I haven't heard a compelling argument for how DNSSEC/DANE gives governments any more power than existing DNS delegation.
Domain validated certificates do not require a new protocol however.