While adding a new CA to trusted set requires some kind of rigor, there's a quite large selection of CAs that were just "always there". Since many browser vend

While adding a new CA to trusted set requires some kind of rigor, there's a quite large selection of CAs that were just "always there". Since many browser vendors are reluctant to remove CAs (because it breaks lots of websites for users), they don't have too much leverage enforcing security practices.