This is why the people advocating this are also advocating alternative CAs like letsencrypt, where the process is automated, only requires proof you control the

This is why the people advocating this are also advocating alternative CAs like letsencrypt, where the process is automated, only requires proof you control the domain (no real world info needed), and is free. Thus, the CA model is used, but only at a bare minimum. Then again, I'd like to see browsers support an encryption model based on DNS records, using one of the many unused crypto record types, like KEY, for delivering the private key's fingerprint. For basic use, there would be no need for an outside party to verify its validity, just that the connection isn't being tampered with. This way, there's no tracking by a central authority unless one wants or needs further verification.