Re: Skipping DNS resolutions with ORIGIN frame

If we can't get consensus on that I'd prefer some kind of stapled assertion
> that kept the perf and privacy properties of the current draft.
>

one other thought while I'm here. If the driving concern is amplifying a
key compromise perhaps making the ORIGIN-as-DNS property contingent on a
strong revocation check would be a workable path.. i.e. use as dns when
ocsp has been stapled or checked (hopefully stapled!).