I think Moxie's "convergence" proposal from ~2011[1] has the most benefits with the least downsides -- in particular I think he really pointed out the crux of the issue: the fact that servers decide who is trustworthy enough to certify their certificates and clients have no input into that decision is a broken model.

This incident was obviously comically bad but the Comodo hack had a more painful impact on the mitigation that should give everyone pause -- their CA had signed a quarter of the internet's certificates so the trust couldn't just be revoked. Imagine one of the LetsEncrypt intermediates got compromised -- our mitigation strategies really cannot cope with that kind of disaster scenario. Browsers would be in the unenviable position where they'd be forced to make huge portions of the internet go dark for potentially months.

[1]: https://en.wikipedia.org/wiki/Convergence_(SSL)

For starters, limit CAs to a specific scope. It's pretty insane a Chinese or Indian CA can certify websites in the Netherlands.

In the 90s vision of a truly globalised world that might have made sense but in today's geopolitical reality it's insane.

If this had been in place already, instead breaking the internet this would have been purely a regional issue.

We should have a very small set of largely not-for-profit CAs run by competent security people, such as Let's Encrypt. There are just too many trusted CAs at the moment, it increases the risk of a breach like this substantially.

You could store the public key for each website in DNS. But now you moved the trust problem to DNSSEC. So far I haven't heard about issues like this for DNSSEC, but then again it is not a massive target currently.

They don't disappear, they are just shouted down by CA fanatics.