If you can delegate a subdomain in a zone file, why don't you just use DNS and DNSSEC for everything and avoid the need for subspaces in your protocol?