[datanut]

DNSSEC + SSHFP is a simple, scalable, accessible solution.

Root CAs are just a bit of a bummer; I hope to be a part of the transition away from them.

[barosl]

I didn't know about SSHFP, thanks for informing me. DNSSEC has always felt cumbersome to set up, so I've stayed away from it. Might give it another try.