I feel this is a perfect complement to the current 1. link: https://satproto.org/ which implements its own CA system with different trade-offs.