Essentially all these systems depend on maintaining the security of a private key which can be compromised in the same way as a client side password. DNS shoul

Essentially all these systems depend on maintaining the security of a private key which can be compromised in the same way as a client side password. DNS should be something that can give persistent assurance even if a site is compromised in the short term. If you give complete trust to the private key, you then need some kind of revocation scheme to remove that trust when it is compromised. Who runs the revocation list, and how do you authenticate the person revoking the certificate? The challenge is really to encourage offline authentication of DNS and SSL certificate changes. It should be something that can be put in a safe and requires physical attack to circumvent. Something permanent enough that loss would be unlikely, and would result in permanent revocation of the domain.