in case you decide not to build again libunbounde, then gnutls-cli should reject the --dane option or always fail when it is used. Accepting it, never evaluating TLSA records and always succeed is the worst combination possible.