Comment by WhyNotHugo

DANE is actually what you want.

A domain owner can publish DANE DNS records with details on the certificate and/or CA used for the domain. With DANE, if a misbehaving CA emits a certificate for your domain, it won't be valid since that certificate doesn't match what you're declared as permitted. This is further solidified with DNSSEC.

Regrettably, none of the major browsers implement DANE, so if any CA emits a certificate for your domain, they'll trust it implicitly.