Another simple mitigation would be the ability for one certificate to be signed by several CAs. We could combined with some DNS records that states the policy

Another simple mitigation would be the ability for one certificate to be signed by several CAs. We could combined with some DNS records that states the policy for validating the certificate (stating the number of CAs to validate a given certificate). It could be a huge improvement on security, and eliminating CAs as single point failures for the whole internet, at least for critical pieces of it.