Ideally you'd have a SQL database and something like a certificate transparency log as a guard against shenanigans. Also, a bunch of regulatory procedures like DNS registrars have to follow.