But there's exactly two types of identity, one of which requires you to have a domain (did:web:), and the other relies on a centralized registry owned by a third party (did:plc:). Still the exact same problem.
So I wonder if the protocol could be extended to allow migrating from a did:plc to a did:web. Or maybe to did:plcalt (alternative plc server. I just made this up but I think you get the idea).
If I understand correctly, it should be trivial to prove you own a plc identity, even if the plc is rejecting further changes to your id, so long as you can tell the network in some way an alternative place to look.
Edit: as per https://updates.microcosm.blue/3lz7nwvh4zc2u it seems like there are some theoretical mitigations to an adversarial plc, but overall it seems like if a plc was adversarial starting today it would damage the ATmosphere quite a lot.