Yeah, I don't know enough about the PKI to comment too much. But since it's still key-based, you could build that whole system on (or maybe around) nostr.