You are already trusting DNS more than CAs. The CN is set to your domain, not to mention that the authorization process for many CAs uses email, which depends o

You are already trusting DNS more than CAs. The CN is set to your domain, not to mention that the authorization process for many CAs uses email, which depends on DNS. This is just another reason why it's so important to get technologies such as DNSSEC and DNSCurve working. As many have pointed out, it make sense to replace X.509 with DNSEC for exactly this reason, so you can verify the SSL certificate by simply doing a secure dns lookup.