Record the TA not EE as the matching cert for usage DANE-TA(2)