That's exactly the reason, why "DANE" approach is developed now, to replace CAs use for HTTPS https://tools.ietf.org/wg/dane/ https://tools.ietf.org/wg/dane/ h

That's exactly the reason, why "DANE" approach is developed now, to replace CAs use for HTTPS https://tools.ietf.org/wg/dane/ https://tools.ietf.org/wg/dane/ http://www.internetsociety.org/articles/dane-taking-tls-authentication-next-level-using-dnssec http://www.internetsociety.org/articles/dane-taking-tls-auth...