The registry, not the registrar (sorry, I managed to mistype above, despite trying to be careful about these terms). The comparison with the CA is apt. The regi

The registry, not the registrar (sorry, I managed to mistype above, despite trying to be careful about these terms). The comparison with the CA is apt. The registry signs the DS record. The model you suggest is a variant of what I allude to in my second paragraph above. That is indeed both an obvious, simple, and much more secure model than the web PKI we use today. I tried to push for similar ideas several years before things like DANE but no one seems interested enough. I have no idea why this is, as the model is both trivial and obvious.