[nick-garfield]

What do you mean by DNS-based PKI? That sounds interesting, but I can't quite visualize what that is.

[cryptonector]

There are two options:

  - registries and registrars run name-constrained CAs

  - DNSSEC/DANE (RFC 6698 https://tools.ietf.org/html/rfc6698)

[dogma1138]

I’m guessing using CERT resource records, that however doesn’t solve how you establish the chain of trust really.