Comment by ggm

Or.. you could use letsencrypt and DNSSEC backed methods like DANE, or DNS existence proofs.