Lets Encrypt (and most other issuers) are happy to issue certificates to whoever controls the DNS for a domain, which could be your TLD administrator at their whim.

I don't think DANE is going to make any progress, but opposing it because it gives TLDs more power is kind of bunk -- the TLDs already have that much power, DANE just makes it more explicit.