By definition, ICANN TLDs are considered special, because the whole www PKI infrastructure only works for those. Browsers cater to those TLDs, and CAs have guid

By definition, ICANN TLDs are considered special, because the whole www PKI infrastructure only works for those. Browsers cater to those TLDs, and CAs have guidelines for those. I understand the need for hiding your TLD though. I don't see a nice solution here, sadly.