I would caution against generalizing from the actions of a CA that only Microsoft is willing to trust. This incident says way more about Microsoft's mismanagem

I would caution against generalizing from the actions of a CA that only Microsoft is willing to trust. This incident says way more about Microsoft's mismanagement of their root store than it does about the WebPKI security model. Also, DNSSEC tampering is no more obvious than WebPKI tampering (how would anyone know if Verisign served a rogue DS record for someone's .com domain to certain resolvers?). Just as with WebPKI, you need a transparency system if you want to make tampering discoverable. (Such a transparency system has been proposed for DNSSEC but went nowhere.)