Because the contract awarding administration of the .us ccTLD to Neustar (acquired by GoDaddy) specifies the certification/spot check process: https://www.ntia.

Because the contract awarding administration of the .us ccTLD to Neustar (acquired by GoDaddy) specifies the certification/spot check process: https://www.ntia.doc.gov/files/ntia/publications/ustld2007_34_apph_nexus.pdf https://www.ntia.doc.gov/files/ntia/publications/ustld2007_3.... NTIA could amend the contract to require or allow a different process that doesn't so readily enable phishing. So, bribe your local legislator if you'd like to see the process changed.