Handshake is another DNS alternative but I do believe it requires using one of their name servers as well. I've dabbled in it but it's been years. I am not entirely sure it would be helpful for the use case but it did mention as a way to circumvent relying on corporate certificate authorities so maybe something there.