did:web (DNS) is just one option for identity. did:plc is what you want, it's not reliant on ICANN or BlueSky.
Any PDS should be able to resolve a did:web or did:plc.
Apologies, I was mistaken. I'd confused the self-certifying bit with decentralization. did:plc relies on trusting a central server to accept all valid events and not allow users to rewrite their history.
https://atproto.com/specs/did