1. Yeah, that's true. It'd need to be something akin to SPF where it gets validated and kept up to date. 2. Yep, you're right. CAA isn't the correct record type. 3. I'd guess that in the vast majority of cases where a TLS cert is used, DNS is also in use. In the case of an offline validation, you're also not able to check CRL, OCSP, etc. so there are already tradeoffs there. Oh, wrt to "secure" - I guess that's the gotcha. DoH would be chicken-and-egg... something like DNSSEC would be needed, though that may be an impossible prerequisite.