See https://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html and https://mail.sys4.de/pipermail/dane-users/2020-September/000579.html about including the `TLSA 2 1 1` for Let's Encrypt emergency backup E2 and R4 intermediate certificates (inactive backup intermediates, see https://letsencrypt.org/certificates/).