More from the authoritative DNS servers than the registrar but with DNSSEC enabled, DANE[0] is a pretty good system.

Google deemed the failure rate of ~2% too high but I hold out hope that banks and other high value targets will use DANE in tandem with the traditional HTTPs CAs and use something like HSTS except instead of requiring HTTPS for a particular domain, will require DANE. Maybe something like viewing your account will accpet a CA signed cert, but an actual money transfer goes through a subdomain that required DANE.

[0] https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...