We do at least have CAA records that you can use to tell clients to only accept TLS certificates from specific CAs for your hostnames, but ideally that would be opt-out rather than opt-in.