apt-transport-https only supports the traditional certificate authority model. However, APT uses GnuTLS, which has a convenient interface for validating certificates with DANE. GnuTLS should be used to provide an alternative to the certificate authorities.