Right now there is a big gap between "trustworthy enough defaults" and "security expert who has the judgment to determine which CAs deserve to be trusted with t

Right now there is a big gap between "trustworthy enough defaults" and "security expert who has the judgment to determine which CAs deserve to be trusted with the most sensitive data". It's easy enough to remove CAs for one's self, the issue is understanding the possible entanglements that might make some of them less trustworthy or more easily compromised. That requires quite a bit of expertise and judgment.