Sort of an idiotic way to do this considering you can use the DNS infrastructure to validate the actual certificate and get rid of CAAs altogether. Chain of tru

Sort of an idiotic way to do this considering you can use the DNS infrastructure to validate the actual certificate and get rid of CAAs altogether. Chain of trust then goes from the owner of the website directly to his or her readers rather than some private organization which by its very nature is already compromised to third parties like the government.