@thegibson If you were designing our PKI system to enable governments and other shady entities to surreptitiously insert themselves, I'm not sure what you'd do differently.

And let's not forget Google's role in ensuring that remained the case by refusing to implement DANE.