Comment by 1vuio0pswjnm7

Perhaps browser fans will check the source code to verify that their browsers or operating systems using DoH ("Private DNS" or whatever they call it) check the certificates presented by DoH providers against CT logs

The dependency of "accetpable", i.e., not self-signed, TLS certificates on DNS, i.e., a domain name in a TLD created by "ICANN", is funny when one considers that the traffic to authoritative nameservers is still unencrypted. It stands to reason that DoH and other "accepted" forms of "DNS security" are only to stop ISPs from stealing Silicon Valley's surveillance advertising racket. Neither is "DNSSEC" providing the user with any real "security"; it's protecting a monopoly. The "security" is against anyone who might try to use domains names not blessed by "ICANN"

Indeed there's no need for CAs just as there is no need for ICANN