At Sat, 15 Feb 2014 20:06:16 +0100, Jakob Schlyter wrote: > > Ah, if you want to require both classic PKIX and DANE, you should do > TLSA {0,1} x y, not TLSA {1,2} x y. Er, no, I really do think I mean usage 2, because this is my own CA.