> have the website define which CA they use, and don't let any of the others certify it.

Isn’t this exactly what CAA records are for?