If someone hijacks DNS to send Google.com requests to their own server, the browser will throw a TLS cert error, no? But if DNS and authentication are the same thing, then hijacked DNS would not throw an error anymore.

Do I understand this correctly?

thats not the point OP was trying to make, the cert is issued via control of the domain, get control of the domain somehow, most any CA will happily issue you a cert for it.

Not all certs, though, right? I believe extended validation certs require more documentation than just domain control.

Go try to get a domain-validated cert for Google. They are in no way relying on DNSSEC.

I suppose that's easy bordering on trivial for an attacker of sufficient skill. At least it used to be. Is that no longer the case?

If there is a blacklist in place, absolutely each and every one of the hundreds of CAs need to adhere to it. One mistake or one exception and I could still get a misissued certificate just as easily as ten years ago.

Google can probably get it revoked very quickly, but we all know how well that works in practice. The only saving grace for the CA system is key pinning, and that's the only reason all those corrupt and/or incompentent CAs were exposed lately. But key pinning is not enough in itself. It is complementary to your certificate validation path(s).

That's great, if you are Google. I unfortunately, am not Google.

You are not Google. How many people are potentially affected if the security of your domain were to be compromised?