Mail address possession verification through DNS CERT and/or PKA

That would integrate nicely with GnuPG and encourage a third key distribution vector besides keyservers and keybase itself. A consideration would be to only accept this if the zone is DNSSEC signed.

For more information see http://www.gushi.org/make-dns-cert/HOWTO.html

Start by reading the linked DNS CERT/PKA HOWTO and clarifying how this proposal should integrate with GnuPG and Keybase's existing key distribution. Define the expected DNSSEC requirement and the user-visible completion criteria before identifying implementation and test locations.

Written by the indexing model from the issue text.