The whole CA model is broken by the OS and browser "every CA is trusted for every use case across any TLD or IP range" without any sort of context of scope exce

The whole CA model is broken by the OS and browser "every CA is trusted for every use case across any TLD or IP range" without any sort of context of scope except dates. Why is it every single one of the 30+ CA roots that Mozilla or Google trusts can issue .com domain certs, not just ones for their local TLDs or local IP ranges which would dramatically limit the blast radius for a breach? Do you really trust that some of these CAs aren't issuing sketchy certificates to their local intelligence agencies, as one of the Middle Eastern CAs was caught doing? To pick on Chrome since they're the biggest, they've got Turkish and Greek, Chinese and Hong Kong and Taiwanese CAs in there, how do you think people in those countries feel about trusting TLS certs from the other sides of disputes? The high bar to establish a trusted CA root in terms of cybersecurity capital investments and audit requirements means there's very few developing country root CAs. What if LacNIC or AfriNIC could run their own CA roots, but they were scoped only to work on IPv4 or IPv6 blocks they managed? Meanwhile, in a corporate enterprise use case, how about being able to trust a CA only to issue certs for my dev and test .local domain, possibly with a scoped range of IPs? At that point, I don't care if that internal CA gets compromised and an attacker issues fake .com certs, my OSes and browsers I installed the CA on would know they're only valid for foobarlab.local on 10.10.x.x - 10.100.x.x or some IPv6 equivalent.