While it's not strictly centralized, as in, there's no single root, the sets of root certs in usage are extremely similar. There are only a handful that matter,

While it's not strictly centralized, as in, there's no single root, the sets of root certs in usage are extremely similar. There are only a handful that matter, and they overlap significantly because they share choices: Windows, Android, Apple, Firefox, various Linux distros. A contributing factor is that the culture that grew around them makes it uncommon to be able to manipulate your own certificates. If you set up a Web page with your own root cert, you can be sure it will never grow.