Require people to submit a public key and two factor serial number during domain purchase, then use that key to sign individual server certificates. If you loose the key or two factor device you loose SSL on the domain, no exceptions. When I go to google.com all I really care is that it is the same site that I visited yesterday. The current SSL scheme gives no such assurance.