If your attack model includes Verisign or a government modifying your DNS zone, then that will allow them to obtain a DV certificate as well. By and large, TLS

If your attack model includes Verisign or a government modifying your DNS zone, then that will allow them to obtain a DV certificate as well. By and large, TLS security depends on the connectness of DNS. Though you could try your luck with HTTP public key pinning (HPKP). I fully agree that 1024 bit keys are silly.