> it should be possible to publish enough information to authenticate a given site against a certificate

You can, it's called DANE and is a future standard [0]. We're just waiting for DNSSEC to spread because without DNSSEC everything is unsecure.

[0] https://tools.ietf.org/html/rfc6698