Is it possible to build a trustless authentication system, that doesn't need certificates ? Cert-authorities have always been a attack-vector, which wasn't too

Is it possible to build a trustless authentication system, that doesn't need certificates ? Cert-authorities have always been a attack-vector, which wasn't too bad because if they got compromised trust could be revoked, minimizing the damage. If that can't be done anymore because of legal or political risk, maybe a better system can be designed, which doesn't have this potential ? Maybe technical design has to take into account the existence of bad political actors, and minimize the political and legal attack surfaces not just the technical ones.