The key could be shared in DNS records or could even literally be in the domain name like Tor. Although each approach has its pros and cons.

On this arm of the thread we're litigating whether authentication is needed at all, not all the different ways authentication can be provided. I'm sure there's another part of the thread somewhere else where people are litigating CAs vs Tor.