On the flip side, more certificate authorities (who, remember, also have the ability to delegate intermediate authorities) also means more attack surface, becau

On the flip side, more certificate authorities (who, remember, also have the ability to delegate intermediate authorities) also means more attack surface, because except in the case of key pinning (which is rare to my knowledge) any malicious authority or compromised authority's certs could be used to effectively intercept web TLS traffic. If let's encrypt was the only authority, yes that would be bad in many ways (and i'm not arguing for that) but it would mean less authorities to worry about. Anyone remember the bluecoat scandal? https://www.vice.com/en_us/article/78kkwd/a-controversial-surveillance-firm-was-granted-a-powerful-encryption-certifica https://www.vice.com/en_us/article/78kkwd/a-controversial-su...