Comment by OvervCW

We do at least have CAA records that you can use to tell clients to only accept TLS certificates from specific CAs for your hostnames, but ideally that would be opt-out rather than opt-in.