> The point is you don't build a system that assumes DNS is trustworthy, because it isn't. But the current CA PKI system already assumes DNS is trustworthy, ev

> The point is you don't build a system that assumes DNS is trustworthy, because it isn't. But the current CA PKI system already assumes DNS is trustworthy, even much more than if you were using DNSSEC-protected DNS PKI system, since it is not only vulnerable to almost all the same attackers/attacks, but it is also vulnerable to many more attackers (since any CA can also do an attack at any time, regardless of any possible future consequences it may experience or not).