Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name?
Doesn't that imply that one highjacked root certificate authority can issue trusted fake certificates that any browser trust. This is not very secure from an end user perspective.
Would it not be more secure that you designate which root certificate authorities are allowed & trusted to sign certificates for your domain name records for example via DNS SEC? Similar DNS examples are also mail SPF records where you say which mail servers are allowed to send mail from your domain.
Why is it designed to trust all root CA to issue certs for any domain name?