That’s all well and good but it seems really unnecessary to paywall it behind what is really an overpriced SSL certificate. IMHO certificate authorities are a

That’s all well and good but it seems really unnecessary to paywall it behind what is really an overpriced SSL certificate. IMHO certificate authorities are a technology looking for validation in their necessity and truthfully the whole business model around CAs is bunk. I can use DNSSEC to provide a verified chain of trust all the way up to the root (.) signed zone. Regardless of “who signed it” anything I put into the DNS zone should be trusted to have been added there by someone who has control of the domain and access to the private key that can sign the zone. This whole song and dance of “pay us thousands of dollars each year for us to verify that you’re allowed to use your own trademarked images” is already a solved problem in the copyright system. See someone using your copyrighted images where they aren’t permitted to? You can sue the violating domain owners for copyright infringement. No “trusted third party” CA handwaving required. Trust me, even the most ambitious of scammers aren’t going to risk that copyright infringement suit when it can potentially result in domain seizure just to spoof BofA’s BIMI image. I understand people like having this third party system that someone else has done all the work verifying Ts are crossed and Is are dotted but the current system in place (third party CAs) are hardly trustworthy themselves and there are numerous examples of CAs that have “gone rogue” and provided certificates for sites that they should not that you can find out on the web if you go looking which is why I’m a strong advocate for pushing DNSSEC in the first place. The domain itself becomes its own source of truth. If I tell you X subdomain should have Y certificate signed by Z authority and that information is securely verified through DNSSEC I can trust that it came from someone with access to the signing key inside that domain.