On: Safari will no longer trust certs valid for more than 13 months

[tptacek]

You're thinking of CAA, which in theory works even if only the CAs look at the records, which is important because no browser will; all mainstream browsers have abandoned DNSSEC, which is moribund.