The public suffix list is a stupid hack that should be replaced by formal protocols allowing boundaries to be defined by either DNS entries, or a file on the web server.
I personally think the public suffix list should be replaced by zero sharing even amongst subdomains, and if you want to talk between x.y.example.org and example.org you can use CORS just like any other cross-domain request.
I think the real challenge is the millions of sites which rely on the existing behaviour.
Do it for every new TLD. Do it for every new domain in an existing TLD. Add an opt-in for security, then start pushing for the security measure, then get browsers to start carrot-and-stick enforcing it...