Stapling is dead: nobody could agree on a threat model, and they ultimately ended up at an HPKP-style cached "this endpoint must staple DANE" model that TLS people rejected (reasonably).

But if you have DoH chaining all the way from the recurser to the authority, it's tricky to say what stapled DANE signatures are even buying you. The first consumers of that system would be the CAs themselves.

That's why I want to use it only for DoH/DoT queries. Which will be used by the CAs to issue the WebPKI certs.

This way, it can be used to guarantee the integrity of the resolution path without first getting a certificate from a CA.

I'm just saying, at that point, you're using a custom TLS protocol, because the real TLS protocol doesn't have a DANE-stapling extension.

Sure. But if it's used only for DoH/DoT queries inside a DNS resolver, its deployment path is more realistic than adding DANE to all the TLS clients.

Right, I agree with that narrow point, but it seems clear to me that neither is going to happen; I think DANE is a dead letter.