15M Budget Line That Doesn't Exist – Certificates (blog.axonshield.com)

Or.. you could use letsencrypt and DNSSEC backed methods like DANE, or DNS existence proofs.