A CA can't steal your private keys, they can issues certs for your domain to themselves regardless of ownership. They could do this even without you as a custom

A CA can't steal your private keys, they can issues certs for your domain to themselves regardless of ownership. They could do this even without you as a customer, atleast untill they get caught and have their root certs revoked by tech companies.