PSL could/should also stop sub.has-a.name trusting signed certs such as wildcard.has-a.name, depending on the configuration of the PSL. I'm just not really sur

PSL could/should also stop sub.has-a.name trusting signed certs such as wildcard.has-a.name, depending on the configuration of the PSL. I'm just not really sure any actual browsers implement it like this though, as reading the PSL "how this is used page" doesn't turn up any such thing. CAA does rely on DNS working, which your registrar can probably hijack. Fair point. CT would help protect against the registrar but not against a malicious CA who simply wouldn't log if they were going to sign a cert maliciously. You're generally right though.