Idea for a protocol similar to BIP353: why instead of encoding some reusable "address" (SP or BOLT12) don't we encode a pubkey and then sign individual addresses with said key?

It can be seen as an extra DNS "delegation" to your wallet signing individual addresses locally

It doesn't solve the problem of being able to pay somebody just by knowing their "username" but we could still validate whether an address comes from a specific person. And this would work on any client with minimal changes, compared to SP which is definitely more tricky

Hardware wallets could take advantage of this by showing the username instead of the address (when shown a DNSSEC proof from the root servers all the way down to the record)