3 ms·

and then hope that every registrar out there is honest...

• 0x0 10y ago
  Not really, it could be set up so registrar CAs would only be valid for domains they are registrars for. Then you just need to pick one trustworthy registrar for your own domains, and you're set. If you can't trust your registrar with your domains, you have bigger problems anyway.