DNS TXT records I can also agree with, as its as secure as email in the respect that it uses the same potential vector for spoofing.<p>File verification (which I haven&#x27;t seen as an option with the multiple CAs I have used) is an alternate vector. It may be in line with the CA&#x2F;B Baseline Requirements, but by removing this  they would likely eliminate this threat.<p>This is a serious problem<p>p.s. I note that this &quot;content change&quot; verification mechanism is mentioned as point 6 under 3.2.2.4 of the Baseline requirements. It is entirely feasible that when these documents were written this particular issue wasn&#x27;t considered. How would one go about repealing this particular point, and thus forcing CAs to comply.