The problem is that facebook.com.google-safe-pages.verizonmobile.evil-site.cn also displays the ‘facebook’ portion leftmost. Also, due to the way DNS works you

The problem is that facebook.com.google-safe-pages.verizonmobile.evil-site.cn also displays the ‘facebook’ portion leftmost. Also, due to the way DNS works you really are trusting ICANN, then the com registrar, then facebook (CAs add an overlay, but then CAs like Let’s Encrypt ultimately trust … DNS). Making that explicit would probably be a good thing (and might even be a first step towards a rootless, decentralised future).