Yep, there is a standard for exactly that - it's called DANE - https://en.m.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.m.wikipedia

Yep, there is a standard for exactly that - it's called DANE - https://en.m.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.m.wikipedia.org/wiki/DNS-based_Authentication_of_... I was quite hopeful it might lead to widespread use of self-signed certs, though with things like LetsEncrypt, it's not really needed any more