As one of these companies (CAs), I think I would certainly worry a little that any one of a few other companies (Google, Mozilla, Microsoft, Apple) could effect

As one of these companies (CAs), I think I would certainly worry a little that any one of a few other companies (Google, Mozilla, Microsoft, Apple) could effectively kill my business. However, I'm not one of these companies (CAs). I am a customer of a couple of them (by necessity, of course) but, primarily, I am just a consumer/end-user of the (CA) service that they provide. From this position, I'm actually quite glad that there are other companies -- the browser vendors -- who can serve as sort of an "overseer" of the CAs. The browser vendors don't have any actual authority over a CAs daily operations or how they choose to run their business, of course. Instead they simply act as representatives of the Internet-using population in ensuring that the Baseline Requirements and their own (root inclusion) policies are adhered to. As an example, I think it's pretty much a given that Equifax is going to emerge from the recent compromise relatively unscathed. They might have to pay a fine or settle a class-action suit or something but, for the most part, it's going to be business as usual for them. Time will pass and we'll forget about this incident. Those of us who are/were affected are left without any real recourse. If a CA had a major compromise like this, however, the CA would almost certainly not get off so easily. We have the corpse of DigiNotar [0] as proof as that. The browser vendors' decisions to remove the DigiNotar roots from their trust stores was, effectively, a death sentence for the company and, in my opinion, a well-deserved one as well. It should -- and, I'm sure, did -- serve as a warning to the other CAs. If nothing else, the "authority" that the browser vendors do have is a benefit to everyone. I think the CAs clearly understand what can/will happen if they choose to flagrantly violate the BRs and/or allow a major security incident to happen and I believe that is motivation for them to ensure that they do their job properly. It's reassuring to me -- as an "end user" of these CAs -- to know that their will be repercussions if they don't. [0]: https://en.wikipedia.org/wiki/DigiNotar https://en.wikipedia.org/wiki/DigiNotar