How do you tie a domain to a key in this model? That's the specific thing that CAs do. The Wikipedia article seems to hand wave over this and I don't see an obvious answer on the namecoin site (though I assume it's there if I dig enough).

You register a domain by spending namecoin in a reg tx, which becomes immutable in the bc. Problem is that when a court says Cocacola.blockchain_namespace is the legal property of the Coke, and the owner is some kid in China who won't hand over the keys, no Corp would use it for DNS.

Names should be strong to prevent spoofing but not so strong that squatters and unlawful holders of keys can disrupt their legitimacy.

So basically it doesn't at all solve the problem. Immutable domain names are not a good thing in general (though certainly in specific cases it could be), especially when as you noted squatting is inevitable.

I don't know if there are established formats to do it, but you would publish the public key in the namecoin record of your domain. You can only do that if you currently own the name in the namecoin chain, similar to how DANE would put a key into DNS.