Google already can mess with your domain quite a bit (how many people use Google's DNS servers?). They also have a registrar and a CA already that your browser

Google already can mess with your domain quite a bit (how many people use Google's DNS servers?). They also have a registrar and a CA already that your browser trusts. Amazon does the same thing. Don't know about MS/Azure, but if they don't now, I'm sure they will soon. FB is the only one that I don't think has neither, but they are also the ones I think that are least likely to actually maliciously mess with domains and TLS. It's just not in the business model. Besides, this doesn't have to be a thing that's under the direct control of any of these organizations, but rather a separate entity that's just financed by them. Gandi or GitHub would be cool too.