Forgive an uninformed comment, but isn't DNSSEC the only viable route away from globally trusted CAs? And the CA model is just fundamentally wrong in many ways (still better than nothing or trust on first use though).
It's only a route to the same thing, but with weaker crypto, no Certificate Transparency, and no ability to distrust bad actors (distrusting Symantec's Verisign CA is feasible, but dropping Verisign's `.com` is not).
Not really.
You cannot get .tk operator to sign .jp domain (unless they're both controlled by same authority, which usually isn't the case).