> Why isn't there a mechanism where a domain owner can specify which CA it allows?

There is DANE (TLSA) but seemingly only supported by e-mail software and not web browsers.