Agreed 100%. I would prefer a "kinda federated" model where the owner of a domain registers a private key with a Domain Registrar, and CAs send CSRs to Domain

Agreed 100%. I would prefer a "kinda federated" model where the owner of a domain registers a private key with a Domain Registrar, and CAs send CSRs to Domain Registrars to validate, and when the CA issues a cert, the browser can validate the registrar signed it (and who the domain's registrar is). That avoids all 9 unique attacks on CA validation, and more importantly, actually cryptographically verifies if the CA should issue a cert, which does not happen at all today.