they can fetch the key or its hash from DNS. it's not like the current system is that much more involved. current system is basically a third party signed cache of such ownership claims validated based on ability of someone to modify DNS records.
All caches are just functionally useless layers..., so that's that.
How do I know that the DNS record is owned by the entity they are claiming to be? CAs have nothing to do with caching.
You don't know that even with DNS validated certificates. There's no separate "entity" claim other than "anybody with DNS record modification rights for a given domain".
You can give out the same claim over DNS directly without any extra third party involvement in the form of CA.
Huh, wow. I kind of thought the whole point of CAs was to do identity verification. It they have dropped that entirely, what is the point?
DNS can be trivially MITM'd as well, it's certainly not a secure mechanism for distributing keys.
You just taken down the whole business of dns validated CA issued certificates. Go claim your bounty. :)