Trust isn't that centralized. Thanks to Certificate Transparency, a CA cannot issue a certificate that will be accepted by Chrome or Firefox without the site owner being able to detect that.