WebPKI can't eject the bad actors that would cause trouble in DANE either. If your TLD conspires against you, they can certainly establish domain control and get a properly issued WebPKI cert.

Visibility through Certificate Transparency logs would at least make it a matter of record that it occurred, though.

The WebPKI semi-routinely kills certificate authorities. The point is that you can't kill a TLD operator.