Comment by tptacek

The problem with this is risk management. In reality, MITM attacks on DV issuance are vanishingly rare --- and close to infeasible in many important cases. But misissuance of DV certs is less rare; it just doesn't happen with MITM attacks. Rather, the usual cause is registrar account takeover.

DNSSEC isn't going to happen, among other things, because it doesn't address a meaningful threat to the WebPKI.