But even with today&#x27;s SSL CA system, those entities (registars, TLDs, ICANN) have full control. They could easily override the NS records and&#x2F;or WHOIS for a domain targeting a domain-validating CA, and receive a valid certificate.<p>Might as well place the CA authorities with the TLDs, then. At least that would limit their authority to their subtree, instead of the free-for-all that is the current CA club. It might even let end-users make a semi informed trust decision: &quot;.be seems to run a tight shop and appears trustworthy, .ly not so much&quot; (random TLDs picked for example purposes only).<p>It would even make it worthwhile for site owners to pick a more reliable&#x2F;valuable&#x2F;expensive TLD (and thus CA), since it would bring a generally-accepted-to-be higher level of trust.