What ever happened to HPKP? It seems like that would somewhat mitigate these attacks since they rely on using their control over the domain to get a new DV cert. A pinned certificate would at least protect those who have accessed the sites before.
There's validity in the approach and I hope it comes back sometime, maybe with additional mechanism around managing pins.
I never set it up for any of my sites for the same reason, just too many ways for it to go wrong.