[cryptonector]

There are two options:

  - registries and registrars run name-constrained CAs

  - DNSSEC/DANE (RFC 6698 https://tools.ietf.org/html/rfc6698)