DANE (and generally anything that depends on DNSSEC) is dead technology at this point, with zero adoption in browsers. Arguably it offers less protection against malicious TLD or root because you don't get any logs. (well, you could require both with PKIX-EE mode, but that's getting really complicated to configure)