"More CAs" == worse. I don't know what "different distribution" means. Anything that doesn't have a strong hierarchical binding to the names users understand

"More CAs" == worse. I don't know what "different distribution" means. Anything that doesn't have a strong hierarchical binding to the names users understand (domainnames) is simply not going to have better security than WebPKI.