1. Store the certificate directly in DNS, signed by DNSSEC 2. Have a way for user to easily and prominently display name or domain who is the certificate issue

1. Store the certificate directly in DNS, signed by DNSSEC 2. Have a way for user to easily and prominently display name or domain who is the certificate issued for, hardware button would be best IMO. No participant in this CA racket has any interest for this to happen...