Comment by tptacek

A lot of practical security is, in effect, band-aids over flawed systems. But I think it's useful to remember that the WebPKI doesn't actually want arbitrary secure DNS; it wants proof of domain ownership. There are ways to deliver that without forklifting in an entire new non-transparent PKI, especially since literally the only thing it will be used for is proving domain ownership.