If I understand correctly, Certification Authority Authorization DNS records are used to specify which certificate authorities are allowed to issue certificates for a given domain. If that record exists and a CA is not listed on it, that CA must refuse to issue a certificate for the domain.
However, this doesn't seem to protect against vulnerabilities in the CA. If any trusted authority doesn't implement CAA properly, or if an authority's private keys are breached, then CAA doesn't help.
My question is, why don't browsers check CAA records? If the certificate given was not issued by a CA authorized in the record, then it would consider the certificate invalid. This would greatly increase security by reducing the list CAs that must be trusted to only the ones the website owner chooses to trust.
I understand that HPKP is also used to prevent bad certificates. However, it only works with HTTP, and it requires either trusting the first certificate received for a site, or trusting a third-party preload list.
So is this something that browsers could implement, or am I missing something here?