The whole CA model is broken by the OS and browser model of "Every CA is trusted for every use case across any TLD or IP range" without any sort of context of s

The whole CA model is broken by the OS and browser model of "Every CA is trusted for every use case across any TLD or IP range" without any sort of context of scope except dates. Do you REALLY trust that some of these CAs aren't issuing sketchy certificates to their local intelligence agencies, as one of the Middle Eastern CAs was caught doing? Why is it every single one of the 30+ CAs that Mozilla or Google trusts can issue .com domain certs, not just ones for their local TLDs or local which would dramatically limit the blast radius for a breach? To pick on Chrome since they're the biggest, they've got Turkish and Greek, Chinese and Hong Kong and Taiwanese CAs in there, how do you think people in those countries feel about trusting TLS certs from the other? The high bar to establish a trusted CA in terms of cybersecurity capital investments and audit requirements means there's very few developing country CAs. What if LacNIC or AfriNIC could run their own CAs, but they were scoped only to work on IPv4 or IPv6 blocks they managed? Meanwhile, in a corporate enterprise use case, how about being able to trust a CA only to issue certs for my dev and test .local domain, possibly with a scoped range of IPs? At that point, I don't care if that internal CA gets breached and an attacker issues fake .com certs, my OSes and browsers I installed the CA on would know they're only valid for foobarlab.local on 10.10.x.x - 10.100.x.x or some IPv6 equivalent.