Startup idea: .nonpublic trusted TLS

A registrar only controls NS records (and glue A/AAAA) required for delegation. It seems impossible to enforce the no address record policy.