The problem with this is risk management. In reality, MITM attacks on DV issuance are vanishingly rare --- and close to infeasible in many important cases. But misissuance of DV certs is less rare; it just doesn't happen with MITM attacks. Rather, the usual cause is registrar account takeover.
DNSSEC isn't going to happen, among other things, because it doesn't address a meaningful threat to the WebPKI.
Don't focus too hard on the current method. Just work with me and imagine a value that comes direct from the registry and there's some kind of secure link, maybe DNSSEC maybe not.
The problem with this is risk management. In reality, MITM attacks on DV issuance are vanishingly rare --- and close to infeasible in many important cases. But misissuance of DV certs is less rare; it just doesn't happen with MITM attacks. Rather, the usual cause is registrar account takeover.
DNSSEC isn't going to happen, among other things, because it doesn't address a meaningful threat to the WebPKI.
Don't focus too hard on the current method. Just work with me and imagine a value that comes direct from the registry and there's some kind of secure link, maybe DNSSEC maybe not.