It should, though it achieves that goal by a chain of certificates not unlike CAs just tied to DNS. Like I said, it essentially just moves the problem.

Which might still be better, if only because it limits the surface area.