Why? Because DNSSEC can be attacked by the DNS root?

It seemed to be our best attempt to get SSL for every website. CA-based certificates just won't cut it.

Because replacing a PKI run by companies that the NSA can coerce with a PKI run by the US Government doesn't seem like a good plan? That, along with the litany of reasons why DNSSEC is a terrible design; that it doesn't secure queries from stub resolvers where the need is greatest; that it publishes internal zone names; that it breaks the resolver API and will inevitably create outages; I can go on.

(I doubt this is what's held up DANE; rather, the unreliability of DNS compared to hyper-optimized HTTPS/TLS connections is the issue there; browser vendors care about milliseconds.)

How is it worse than X.509?

Here we go again :-)

can anyone point to a link that explains X.509 s shortcomings? I'd really like to read up on that but can't find any sane info.

Haha consider the possibility that some of the insane ranting you hear about x.509 is actually balanced and accurate criticism :-)

hehe, so true.