As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors). My attempt at explaining the issue: Currently, CAs are ...
If I'm visiting (just a desktop pc, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using [not with free will, so e.g.: I'm "attacked"] a rouge DNS ...