> Why are they (DNSSEC + WebPKI) never considered complimentary?

WebPKI works without DNSSEC, whereas DANE (a more secure WebPKI replacement) depends on a robust DNSSEC deployment.