Yes, if you're okay with doing away with the concept of zone delegation beyond the top level domains, you can make proof of ownership a lot simpler and just validate directly with the registries.
If you want to keep zone delegation, your proof of ownership PKI is going to end up having to solve many of the same problems DNSSEC tries to.
And the thing is, once you have a secure, automated way for websites to prove ownership of a domain, the necessity of trusting a bunch of third party CAs to validate that information for you starts to become questionable.
If you want to keep zone delegation, your proof of ownership PKI is going to end up having to solve many of the same problems DNSSEC tries to.
And the thing is, once you have a secure, automated way for websites to prove ownership of a domain, the necessity of trusting a bunch of third party CAs to validate that information for you starts to become questionable.