Relays could be known by a keypair (and DVMs too). But a lot of bits of nostr currently use URLs. So that means relay hints using pubkeys would need to become acceptable, nprofiles too, relay lists, and lots of software that presumes otherwise will need to index relays by their pubkey and URL until the transition happens. It is a big move and will take a long time to migrate and we haven't really even started yet.

But in the end we no longer depend on DNS or Certificate Authorities (we can use our own keys for SSL, relays would issue an ed25519 subkey pair for it, certified by their nostr key).

That is, all the things about the Internet that are top-down authoritarian things... we can weasel out from under them if we migrate in this direction.

I imaging going even further. I'd have a web server that served normal content over TLS port 443, but if you include a certain header magic it becomes a nostr relay. So in China the CCP will see it is just a normal website, and all the encrypted traffic to that website looks totally legit... but it's secretly a nostr relay behaving differently upon the passphrase. (Such schemes fail via infiltration, but at least it makes the scheme possible).

I like DHTs. I think mainline DHT is good. We have code for bootstrapping keys and relays and URLs from mainline DHT. But it is in rust and I'm not sure it is technically "simple" enough for nostr.