It is - generally speaking - enough for the attacker to compromise one CA. Every CA can issue certificates for all domains, with some exceptions where the brows

It is - generally speaking - enough for the attacker to compromise one CA. Every CA can issue certificates for all domains, with some exceptions where the browser knows which CA should be issuing the certificate. Google chrome has a hardcoded list of high value targets, IIRC. All of that is ignored when you have a local CA trust root, though, like many enterprises do (for their TLS intercepting proxies) And for those CAs, even the safeguards as certificate transparency are moot. As a consultant, I never accept to install one of those CA certs in my trust store. I’d rather go and use a VM or a dedicated machine.