Comment by jackweirdy

I disagree with this completely. The CA Model is absolutely flawed, and this is just patching a flawed model. I'd love to see a push for [DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...) - where you publish your public key in DNS. When doubled with DNSSEC, this means your IP address is irrefutably tied to your domain and so is your TLS public key.