> it should be possible to publish enough information to authenticate a given site against a certificate You can, it's called DANE and is a future standard [0]

> it should be possible to publish enough information to authenticate a given site against a certificate You can, it's called DANE and is a future standard [0]. We're just waiting for DNSSEC to spread because without DNSSEC everything is unsecure. [0] https://tools.ietf.org/html/rfc6698 https://tools.ietf.org/html/rfc6698