Describing the current CA system for TLS certificates as the peak of what is currently possible is simply untrue. As it happens, there is a solution, and I described it. Domain names can be tied to a strict key hierarchy using DNSSEC, and DNS for domains can in turn contain PGP keys (or any other kind of verification data). This way, a package could be directly verified as being issued by a current owner of a domain name.

The fact that we all use and trust CA-issued certificates today is not an argument for accepting that system as the best we could ever do in the future, or even today. And the fact that one wishes to improve the current situation does not make it wrong to use the current system as it is – to claim otherwise is to be Mister Gotcha (https://thenib.com/mister-gotcha/).