Create your own root certificate, import it into your browser, and into the OS certificate store. Then just sign CSRs with this root certificate's private key.

This is pretty much what all large corporations do for their internal infrastructure.

This of course, only works for your own internal use. I feel this disclaimer needs to be called out explicitly.

If you're trying to do something that will be trusted by the global internet, you'll need to use an official CA, ergo the complaints of DNSSEC being too 'centralized'.

Then again, what the "global CAs" are doing is not wholly different in a technical level than what a company with their own internal CA does, except that I hope the global CAs take security very very seriously, and they pass an expensive audit.

In the end, it is just some company or organisation that creates a root CA cert and intermediaries, and then jump through hoops to make browsers and OS cert stores add their certs. Not saying it is easy, just that the technical parts are rather similar, the rest being a cumbersome way to prove you are trustworthy by showing off your processes and fences around the signing boxes.

In the case of DNSSEC, the ultimate 'root key' is handled quite carefully and is interesting to read up on.

https://www.iana.org/dnssec/files

https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/

One can distribute self signed ssl certificates. Not using a CA is more secure for the group relying on the certificates to maintain encryption.

and, if you have a compelling reason, you can convince other CAs to cross-sign your certificate, like LetsEncrypt did: https://letsencrypt.org/2020/09/17/new-root-and-intermediate...

Browsers control what they trust, too, and can remove roots if they’re behaving poorly: https://blog.mozilla.org/security/2011/08/29/fraudulent-goog...

That is to further your point: there is no central decision-maker

Browser can also use self-signed certificates to trust lists.

Openssl works just fine, if you're asking in earnest.

Either way, it has no bearing on DNS.