DANE can be used to distribute certificates with some authentication via X.509. It would be good if Sequoia and sq would support it, in addition to WKD and key servers.
sq