People can generate certificates as they please, including for public domains. The only thing well-known CAs bring is that they work out of the box in browsers

People can generate certificates as they please, including for public domains. The only thing well-known CAs bring is that they work out of the box in browsers/OSs as they act as trusted third parties, but you can add you own CA to your browser/OS if you wish. No sharing of private keys involved.