I mean strictly in the sense that we already have root servers pointing to TLDs pointing to individual domains all the way down. I'm not suggesting DANE in part

I mean strictly in the sense that we already have root servers pointing to TLDs pointing to individual domains all the way down. I'm not suggesting DANE in particular here I'm suggesting trust one "Super CA" that signs a "sub CA" for a TLD that signs another sub CA for the domain which can keep doing the same thing. Basically just chain each CA together but all of the sub CAs would be further and further constrained such that .ly couldn't sign certs for .com and ycombinator.com could only sign certs for subdomains of ycombinator.com. In essence, we already trust the registrars to link a name to an entity, DV certs are just going to defer the judgement to the registrar so why bother trusting an additional entity to issue certs for every domain instead of just having the registrar sign your CA that can only issue for your domain and only until your domain expires. Right now AFAIK I can technically get a SSL cert for a domain I control and have it expire well past when the domain expired and was transferred to another party. I now have a valid certificate for a domain that I don't own.