Why would I trust my domain registrar to maintain PKI? They don’t seem inherently better suited for it, and in various ways are more susceptible to meddling for e.g. ccTLDs.

I think the idea that CAs are uniquely incompetent is probably incorrect.