> put my own domain-specific CA Cert in DNS directly.
Remember that this allows any of your government or people controlling the zone to transparently put the cert there too. (For potential problems see [0]).
With the CA system (that I personally also don't like) at least the certs are logged in Certificate Transparency logs so you see any potential attacks.
Remember that this allows any of your government or people controlling the zone to transparently put the cert there too. (For potential problems see [0]).
With the CA system (that I personally also don't like) at least the certs are logged in Certificate Transparency logs so you see any potential attacks.
[0]: https://www.theguardian.com/technology/2010/oct/08/bitly-lib...