For domain validated certificates, the DNS does essentially function as a sort of distributed CA; if you control the DNS for a domain, you can get the certificate issued: this isn&#x27;t insecure, it&#x27;s by design.<p>Unless we&#x27;re talking about removing domain validated certificates, I don&#x27;t see why explicitly treating DNS as a CA, when it&#x27;s a de facto CA is a problem.  I&#x27;m not sure how we can get to HTTPS everywhere without domain validated certificates?