For RDAP to work (for instance) you only need to bootstrap with secure connectivity to the registrars. Current DV challenges have a much harder problem: they have to work with every zone on the Internet. There's no real reason to accept that constraint!

When we think about "sound engineering" this is the level we need to start at, not "what features could we bolt on to core Internet infrastructure to define the problem away".

The people most avidly pushing DNSSEC for this problem aren't stupid. They're just smuggling in an additional premise: that the WebPKI itself is bad, and should be replaced with a DNS PKI. Seen through that lens, secure proof of domain ownership would be deeply problematic, as it would leave the DNS PKI with literally no reason to exist.