I'm not sure I agree that trusting subdomains "greatly expands the default trust surface". That's part of the premise of the domain hierarchy: the owner of a do

I'm not sure I agree that trusting subdomains "greatly expands the default trust surface". That's part of the premise of the domain hierarchy: the owner of a domain owns all the subdomains. If you don't trust the policy by which they grant subdomain control to others, then you don't trust the domain. This is the same policy that all browsers use; it might be surprising to folks unfamiliar with URLs, but the article's tone suggests that it's crazy and weird, which definitely isn't the case.