It does sometimes feel like lack of secure chain DNS, however exactly implemented, is one of the original sins of the modern internet that has caused a lot of h

It does sometimes feel like lack of secure chain DNS, however exactly implemented, is one of the original sins of the modern internet that has caused a lot of headaches and layers upon layers of bandaids ever since. Doesn't mean it'll ever be solved of course, the legacy support issue at this point is pretty brutal. But DNS has already effectively ended up as the root of trust for a lot of auth anyway, if an attacker somehow gets access to someone's registrar account they can from there trivially bootstrap. Rather than so many root CAs that can also issue certs for any domain, seems like it'd be pretty nice if we could just depend on DNS and then have an "authorizedCA" record or whatever and stick any public certs(s) in their the domain owner desired. Could be a 3rd party, could be their own CA, but the only CAs that could issue a cert for that domain would be the one's the domain owner wanted which is how it's supposed to be anyway right? Ah well.