Comment by account42

DNSSEC has the inherent advantage that only the root servers could have the same impact as any CA dpes mow because anything below them has much more limited scope. And any software that is reasonably updated can just pin the DNSSEC keys for TLDs and then you have no single entity with global fuck up potential.

It's also worth remembering that domain validated CA certificates already rely on trusting the DNS hierarchy as the source of the information they certify.