Thinking this through a bit more, this could in theory be technically possible but makes a few big assumptions that I would never expect to occur. Rather than

Thinking this through a bit more, this could in theory be technically possible but makes a few big assumptions that I would never expect to occur. Rather than CA's issuing certs, they could entirely stop that and instead issue restricted signing certs. People could plug the restricted signing cert into their internal CA and/or automation frameworks and/or cert generation tools such as certbot assuming code changes and/or some CA LUA script served by a load balancer and let the load balancer issue dynamic on-demand certs signed by the restricted signing certs. There are many pros and cons to this and many projects would need code changes. The certificate transparency systems would need an overhaul and some things would be less visible. Signing certs can be restricted to any level from TLD to Apex to sub-domain and some CA's do sell them to very big customers, but maybe this could be automated to allow any size organization or individual to do the same thing. The signing certs could be good for 90 days and the certs generated by them could be valid for any period up to 90 days. For the record I do not believe this would ever come to pass and I fully expect a few people to respond saying it is not possible to restrict a signing cert to a sub-domain but that is just not true. Some here are in government organizations that have completely unrestricted signing certificates so that is what they know exists.