[account42]

If DNS poisoning is so easy why don't you perform the same attach on Let's Encrypt since that also uses plain HTTP.

[jefftk]

Certificate Authorities are extremely careful about DNS (and BGP hijacking), more so than basically everyone else.