It just moves the basis of trust from a diverse network of private CAs, any of which can be individually punished or distrusted if they misbehave, to the single centralized system of DNS, which rolls up to whomever controls your TLD of choice--entities who usually can't be removed, punished, or replaced.

Entities who also can de facto pull enough strings to authenticate to any CA as you, even under the existing system.

There's a blockchain project that attempts to decentralize TLDs - people would actually own their TLDs (by cryptography!), and would issue their own certificates. Only you and no one else would be able to issue a certificate for your TLD.

I've been shilling for this project enough, and feel it's a little offtopic here, but if you're really interested you can find it in my recent post history :)

Frankly, that's bullshit. Now you have to trust your country or some other private entity, without all the protection mechanisms modern Web PKI has.

Lets Encrypt (and most other issuers) are happy to issue certificates to whoever controls the DNS for a domain, which could be your TLD administrator at their whim.

I don't think DANE is going to make any progress, but opposing it because it gives TLDs more power is kind of bunk -- the TLDs already have that much power, DANE just makes it more explicit.