DDoSing DNS would break everyone's browser for lulz too, but somehow the net manages to chug along. And if/when it happens, at least people know they're under attack and direct attention to fixing things.
A service with a clear single point to DDoS is obviously the wrong choice.
What if services all over the net could tell you the latest (<5 minutes old) root/summary-hash of the shared dataset? And, there are many places to either update yourself to that version, or receive a trustworthy proof a certificate is/isn't in that dataset?
If they're all blocked, an alarm should go off, letting the user know it's dangerous to proceed. The failure shouldn't be secret, with the confidence-inspiring lock icon still appearing, for indefinitely long periods.
While sitting in a meeting I realized there is one situation that online revocation helps: someone steals bank.com's DNS record. They can't necessarily MITM anyone with that.
But, TACK is probably a better countermeasure there.