I'm not really in favor of DANE, because DNSSEC is such a mess ... but.

Certificate transparency is nice. Browsers could require it for DANE certificates, just like they require it for current Web PKI certificates.

The people controlling the TLD of interesting can exert control over the domain of interest in order to issue a DANE certificate. But they can also exert control over the domain of interest in order to request a domain control certificate, so widespread use of DANE wouldn't add any new adversaries. If DNSSEC wasn't a mess, and DANE replaced WebPKI, we would eliminate the risk from CAs without adding a new risk --- TLDs (and the DNS root) are existing risks.