Comment by wav-part

DNSSEC+DANE replaces registrars. The entity would push signed request directly to tld.