If the URI RFC mandated https://[fingerprint] https://[fingerprint], I'd agree with you. But the TLD is the entity we trust with the responsibility of delegatin

If the URI RFC mandated https://[fingerprint] https://[fingerprint], I'd agree with you. But the TLD is the entity we trust with the responsibility of delegating domains in the juridical sense anyway. If they say I own Google.com, I own it in every possible way, and I should be able to generate certificates for it. That's regardless of whether we use a CA model or a DNS-delegated one such as DANE. I would be perfectly fine with a model where we store certificates directly in WHOIS, but that would be slower and less practical that just using DNSSEC, which is already deployed.