I agree the whole design is horrible. I would much rather have had no DNS records whatsover, and instead used onion-style layered TLS, rather like how 802.1X works with outer and inner authentication. The browser would first initiate a TLS connection to the IP address, using the IP address as subject name. It then creates a second connection inside the first using the domain name as subject name.