The idea was that users should want to validate they speak with the organization McDonald's, not with mcdonalds.com which may or may not belong to them. Turns out users don't, and that the distinction gets even less important over time. Domain names is an important identifier for an organization now. You can still however see the old process at work in EV certificates, which normally carries an extra cost.

If SSL had been designed for domain validation from the start, if would have looked like DNSSEC. Cryptographically verified domain assignments is a good idea, and infinitely more secure than the domain validation schemes we use today.

Here at HN there are a handful who can't resist going on about NSA every time DNSSEC is mentioned, so I expect a few of those now. Please do understand the whole picture and how the complete certificate stack works before taking those statements at face value.

Now you might say don't trust the registrar, trust the people who run the .com (or whatever) TLD. That's getting close to what DNSSEC does, which some people say is better. But CAs weren't designed for this like DNSSEC. With the way CAs work, we would have to give the runners of .com power over all domains, which some people might not think is so bad. But it would also mean we would have to give the owners of .sucks power over all domains as well, which most people would be against.