You could have another infrastructure class (next to blossom servers, mints and all the rest) which is transparent alt root resolvers (TEE based), and that would abstract away the blockchain and the fingerprint validation for users (they just enter the URL) and would work with whatever alt root that the server op wants to publish IP and fingerprint records on. I just dunno if that's that much of an upgrade to ICANN DNS. ICANN could have turned out a lot worse than it did.