There are two options:

  - registries and registrars run name-constrained CAs

  - DNSSEC/DANE (RFC 6698 https://tools.ietf.org/html/rfc6698)

I’m guessing using CERT resource records, that however doesn’t solve how you establish the chain of trust really.