Do it for every new TLD. Do it for every new domain in an existing TLD. Add an opt-in for security, then start pushing for the security measure, then get browsers to start carrot-and-stick enforcing it...

It's possible to make things better.