This is the correct take. There's a bunch of policies and practices but essentially dozens of shady providers have complete ability to impersonate anyone on the

This is the correct take. There's a bunch of policies and practices but essentially dozens of shady providers have complete ability to impersonate anyone on the web, and the behavior of those policies and practices is set by a might-makes-right of the most popular browser vendors. The entire system is equal parts insecure and absolutely impractical, such that 80% of organization have had an outage caused by certificate issues but certificates aren't meaningfully providing security.