Technically, it's replacing two groups of people you have to trust with one, since gaining control of a site's DNS is sufficient to issue certificates for that

Technically, it's replacing two groups of people you have to trust with one, since gaining control of a site's DNS is sufficient to issue certificates for that sites under the current system.