Comment by datanut

DNSSEC + SSHFP is a simple, scalable, accessible solution.

Root CAs are just a bit of a bummer; I hope to be a part of the transition away from them.