Maybe if we switched from the current state of PKI with CAs to DNSSEC and DANE/TLSA, it would be easier. But doing that would mean to either trust the current

Maybe if we switched from the current state of PKI with CAs to DNSSEC and DANE/TLSA, it would be easier. But doing that would mean to either trust the current resolver you are using, which is unacceptable, as it's sometimes cloudflare or google, or running your own resolver on every device -- which also does not work. It is absolutely crucial for the DNS system we have today that there's a small number of resolvers that have large caches, otherwise root servers would blow up. Unless we massively start implementing some novel RFCs.