Post #2447690

@stiiin@infosec.space @i@toot.pouyan.net @freci@piaille.fr @SRAZKVT@tech.lgbt The client doesn't need the DNSSEC signatures (altho it may want them too if the nameservers aren't trusted to validate them); it needs the DANE keys. That's an extra query for TLSA RR type, and could be large if the site does dumb stuff like putting full key/cert rather than hash in there. But it can still be concurrent.