The way to do this is to start inside the existing namespace: get yourself a short 2nd-level domain and start signing people up underneath it. Decide on your own policies for who gets what sub-domains and delegate them out. I'd suggest making WHOIS privacy the default policy, but be sure to keep a chain of accountability so that you aren't providing a spam haven.
The fun starts when the Man comes to confiscate your 2nd-level domain. At that point, if you're big enough and enough people depend on the services resolvable under your domain, you need to do a PR campaign appealing directly to the resolver community and ask them to configure a special exception for your 2nd-level, pointing directly at your nameservers. Gets even more interesting with DNSSEC as they will need to add a DS record as well. You will need an alternative means to publish your KSK to the world. There are some interesting enhancements being proposed for the RPKI to allow this kind of sub-domain exception policy, but we need a few additions to DNS and DNSSEC to make it work smoothly.
I'm all for a new set of policies, but you've got to give props to the current root.
"Let's show this prehistoric bitch how we do things downtown!" -- The Ghostbusters