> Why isn't there a mechanism where a domain owner can specify which CA it allows?

CAA records do this, but only for issuance, not for use, so it only protects against eg. unexpected domain validation, because the CA has to respect the CAA record. Extending that to use seems like a logical step to me.