If you're using the DNS as the root of trust then you can just skip CAs entirely...

account42 22 days ago | parent | context | favorite | on: Parallel Reconstruction of Lawful TLS Wiretapping

If you're using the DNS as the root of trust then you can just skip CAs entirely and have the DNS system authenticate certificates directly. Turns out we already built system.