A quick read-through of the wikipedia page tells me it works as expected. The chain of trust follows the DNS hierarchy which is much saner than trusting all CAs

A quick read-through of the wikipedia page tells me it works as expected. The chain of trust follows the DNS hierarchy which is much saner than trusting all CAs for all domains. If you have yourdomain.com you're already trusting the .com TLD to not redirect your users somewhere else so you might as well also trust them for this. What you describe is basically a self-signed certificate which is known to be a poor solution. It easily allows someone to consistently MITM the whole web (think great firewall of china) without the users knowing.