alt Hacker NewsThere's a whole design space of options here, one of the simpler ones being just checking via the registrar, using a protocol like RDAP. You could also use the DNS for this, but not require the entire zone to be encrypted (you'd be designing a new protocol, but that's what we have to do anyways, since DNSSEC is a dead letter).
Yes. That would fall under the "some kind of similar PKI" category I mentioned, as you'd still need some kind of PKI to secure the RDAP connection. (Perhaps that PKI could be simpler than full DNSSEC, but it would have to solve a lot of the same problems.)