That's not at all what I said. The EU has a government, and I don't think anyone particularly disputes which government is the EU government. (I suppose one m

That's not at all what I said. The EU has a government, and I don't think anyone particularly disputes which government is the EU government. (I suppose one might argue that .tw is a bit different, but that's a whole different discussion, and somehow the DNS root servers know what to return for SOA and NS queries for tw.) I'm saying that I think it really would be reasonable for the EU to require that browser follow a specified mechanism to restrict which certificates are valid for .eu. And it would be reasonable for Hungary to use the same mechanism to restrict .hu. So browsers would only accept a certificate for a .hu domain if it was signed according to standard PKIX and CA/B Forum rules and had whatever standardized attestation was required from .hu.