We should let each country specify trusted CAs the way they specify their DNS signing keys. Or we should just implement DANE already and then the same key serves both purposes and we can delete WebPKI from the world.