You already trust the DNS root, as long as domain names are what certificates are based on. If you can transfer a domain name illegitimately you will have no pr

You already trust the DNS root, as long as domain names are what certificates are based on. If you can transfer a domain name illegitimately you will have no problem getting a completely legitimate certificate signed. But the fact that domain names are hierarchical means you have to trust one or two entities at most. That's why domain name theft is historically less common than illegitimate TLS certificates. You'll find all sorts of arguments that the CAs do more things than that and no end of security professionals who work for them. Some of these arguments are probably correct but that doesn't change the overall picture how a secure global TLS PKI should operate in the presence of domain names. It does the current system quite resistant to change however.