DNSSEC+DANE replaces registrars. The entity would push signed request directly to tld.