But we have the atea tool now. Haven't we? You can use it to download via DNSSEC/DANE. And I believe Elmar is going to continue support for it. Debian itself can always support DANE as long as there are working DNSSEC impementations. Just provide a TLSA record. And I would believe that to be valuable since the problem about DNSSEC/DANE support is a bit like the hen and egg problem.