and, if you have a compelling reason, you can convince other CAs to cross-sign your certificate, like LetsEncrypt did: https://letsencrypt.org/2020/09/17/new-ro

and, if you have a compelling reason, you can convince other CAs to cross-sign your certificate, like LetsEncrypt did: https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html https://letsencrypt.org/2020/09/17/new-root-and-intermediate... Browsers control what they trust, too, and can remove roots if they’re behaving poorly: https://blog.mozilla.org/security/2011/08/29/fraudulent-google-com-certificate/ https://blog.mozilla.org/security/2011/08/29/fraudulent-goog... That is to further your point: there is no central decision-maker