Use the DNSSEC signature infrastructure. Generate your own self signed SSL certificate, then stick a hash of that cert in the DNS for your DNSSEC protected dom

Use the DNSSEC signature infrastructure. Generate your own self signed SSL certificate, then stick a hash of that cert in the DNS for your DNSSEC protected domain. Of course, people need to start using DNSSEC, and browsers need to be updated to work with this system, but it beats paying a CA.