did:web (DNS) is just one option for identity. did:plc is what you want, it's not reliant on ICANN or BlueSky.
Any PDS should be able to resolve a did:web or did:plc.
did:plc is currently centralized, it's 100% reliant on Bluesky. Lookups have to be done at https://plc.directory/
Apologies, I was mistaken. I'd confused the self-certifying bit with decentralization. did:plc relies on trusting a central server to accept all valid events and not allow users to rewrite their history.