I always thought that was a bad decision, thinking that subdomains could be related security-wise to other domains looking the same. DNS was thought out from t

I always thought that was a bad decision, thinking that subdomains could be related security-wise to other domains looking the same. DNS was thought out from the beginning so you could split it anywhere you wanted to delegate things, and you can also delegate with CNAME too. I'd welcome a security model that does not use origins. It's doable, but the origin trick was a convenient way to enforce some security measures bolted on as an after thought without breaking much the compatibility.