We already have a solution to solve it: DNS-based Authentication of Named Entities (DANE)

This solution is even more obvious today where most certificates are just DNS lookups with extra steps.