OK but if I can't audit my own sysadmin's actions how in the WORLD am I going to audit the actions of the sysadmins of the 150+ organizations that my distro has

OK but if I can't audit my own sysadmin's actions how in the WORLD am I going to audit the actions of the sysadmins of the 150+ organizations that my distro has decided can be trusted to sign certificates for any domain? I still fail to see where a third-party CA brings any value whatsoever here.