Registrars and PKI CAs should be the same orgs (can't do only one) and each domain registration should come with a certificate. How is this not a thing? Only a valid CA for a valid TLD registrar should issue certs for a domain name, not arbitrary CAs. So much could have been avoided with this.

If you're gonna tie your identity to it. PKI is very important. EV pki cert gives me more confidence in the authenticity of your account.

How many people do you think I can fool with trump-white-house.trust (or many other cheaper/easier TLDs)?