Comment by quotemstr

> We already have a functioning system for delegating domain ownership in a hierarchical fashion

Well, yeah. DANE should have won. NameConstraints would be nice tooo, but who's going to make CAs use it?

And FFS, clients could at least check CRLs once in a while.