My use-case is the following:
I have dyndns set up to access my home server from the internet. If I use a DV certificate or a self-signed certificate I'm not actually authenticating the machine but only the domain.
If my account runs out somebody can easily acquire the domain and use e.g. letsencrypt to get a valid certificate. At this point my applications might try to connect to the machine and transmit sensitive data which I would like to avoid.
I assume that doing this in a generic way is impossible but I would be happy about partial solutions that e.g. work only in a Firefox.
The only idea I have so far is to set up a script that will periodically check the certificates and alarm me in some way if they change. That, of course, leaves a window for attacks.