> Allowing user to just generate a domain for themselves That's limited mostly by policy[1], the current PKI environment already allows delegating CA for a sin

> Allowing user to just generate a domain for themselves That's limited mostly by policy[1], the current PKI environment already allows delegating CA for a single domain. [1] https://community.letsencrypt.org/t/sub-ca-with-wildcard-certificate/237578/8 https://community.letsencrypt.org/t/sub-ca-with-wildcard-cer...