Really wishing the Google Chrome performance team had not removed DANE support for TLSA records that allowed site operators to set their TLS certificates for others to trust. Now we have no alternatives but to trust every web PKI certificate. Yuck.
Please @FirefoxOfficial bring back DANE support, do the slightly slower but more safe thing.