If only the registrar holding a domain can issue certs, and for example you don't trust CNNIC or the .cn TLD operator (which also happens to be CNNIC in this ca

If only the registrar holding a domain can issue certs, and for example you don't trust CNNIC or the .cn TLD operator (which also happens to be CNNIC in this case), then you can simply avoid .cn domains and register your domain elsewhere, at a registrar that you trust not to issue fake certificates. If you cannot trust the TLD operator, then you have already lost, as the TLD operator could arbitrarily fake data in WHOIS if only for a second, and obtain a DV certificate from any CA right now, since a WHOIS lookup for an email address is usually what powers the DV. But at least then you'd eliminate the risk of third parties (not the TLD operators) obtaining a parallel certificate that you don't even know about. Right now, I don't think there's anything stopping CNNIC (or any other root CA) from issuing certs for yourdomain.com, and you wouldn't even know it. Might bring some value back into the reputation of TLDs and registrars, as a bonus :)