If you're using the DNS as the root of trust then you can just skip CAs entirely and have the DNS system authenticate certificates directly. Turns out we already built system.