A DNS alt-root and something like x402 would fix this

I still think a decentralized DNS alternative could scale, if done the right way. I also think that the majority of sites would be more secure if they used a system like ssh to deal with certificates, and government-controlled trust chains should be left for banking and other "official" stuff.