Hm. I wonder how often this happens. We should be able to detect it easily if they do it all the time. Today they don't have to.<p>For the long term I wonder if it's possible to close this hole by putting certs into DNS and using a single key to sign all of these DNS records. Is this part of the DNSSEC spec?  (not at a computer and can't remember for sure if it is called DNSSEC; whatever the name of the next gen DNS is.)