[keyassure] Asserting DANE exclusivity for an entire domain

[Matt McCutchen <[e-mail]>]

I would like to assert DANE exclusivity for the entire domain
mattmccutchen.net so that, with respect to clients that check DANE first
and fall back to a mainstream public CA list, a shady CA cannot
impersonate my existing TLS services /or/ fabricate TLS services I do
not offer.  I know I can achieve that by adding enough wildcard dummy
TLSA records to cover the entire namespace as an automated
postprocessing step, but that is a little ugly.

One solution would be to have the client, when no TLSA exists at the
desired host/transport/port after following CNAMEs, search from the host
name up for a "DANE options" record with an exclusivity flag (which
could be on or off).  If no such record is found all the way up to the
root zone, the default is "off".  Do people think this would be worth
the implementation effort and the extra queries?

-- 
Matt