In many cases (such as Let's Encrypt) the CA verification process is merely "controls some DNS resource" or "controls some HTTP response that directly depends o

In many cases (such as Let's Encrypt) the CA verification process is merely "controls some DNS resource" or "controls some HTTP response that directly depends on DNS". In that case it is theoretically impossible for the cert to be more trustworthy than DNS(SEC). [The cert's untrustworthiness is DNS's untrustworthiness plus the CA's untrustworthiness plus some other misc factors, such as TLS library untrustworthiness].