Like I said, I agree with you that a naive, purely DNS-based PKI would be less flexible in that regard. That was a good point, and well noted. However, the cur

Like I said, I agree with you that a naive, purely DNS-based PKI would be less flexible in that regard. That was a good point, and well noted. However, the current status quo is sort of ignoring the big DNS-shaped elephant in the room. You can build all the validation and transparency solutions you want on top of the CA system, but it's still fundamentally dependent on the security of a DNS system that currently requires no cryptographic assurances that the records the CAs are validating against are actually correct.