Verified Mark Certificates: another CA scam

BIMI is a standard wherein you slap in yet another TXT record to specify the avatar to use in mail clients for your domain's email accounts. There's one troublesome bit though. The "Verified Mark Certificate", which is basically a Bag on the Side saying this is definitely for sure not spoofed. The trouble is, only HTTPS URIs are allowed, and mail clients surely won't allow self-signed certs. As…