You always have to trust the DNS, unless you use certificates for something else. (The exception being EV certificates, but it is far from clear how many end us

You always have to trust the DNS, unless you use certificates for something else. (The exception being EV certificates, but it is far from clear how many end users know or care about that.) So the question should be why trust DNS and CA when the DNS is sufficient? And it doesn't have to be DNS, you could use domain names for other things too, but DNS is what end users care about so that's where you need to start.