I /think/ that bandrami is trying to advocate for a DNSSEC/DANE based system for certificate trust which would put the trust in the DNS operators in lieu of the

I /think/ that bandrami is trying to advocate for a DNSSEC/DANE based system for certificate trust which would put the trust in the DNS operators in lieu of the CAs, and be more about asserting "control over domain" than the "is the correct legal entity" that OV/EV (but not DV) certs claim. I'm personally not a huge fan, but (if I'm interpreting her/his argument correctly), it'd at least be secure against a casual MITM.