The problem with this is risk management. In reality, MITM attacks on DV issuance are vanishingly rare --- and close to infeasible in many important cases. But misissuance of DV certs is less rare; it just doesn't happen with MITM attacks. Rather, the usual cause is registrar account takeover.

DNSSEC isn't going to happen, among other things, because it doesn't address a meaningful threat to the WebPKI.

Don't focus too hard on the current method. Just work with me and imagine a value that comes direct from the registry and there's some kind of secure link, maybe DNSSEC maybe not.