Nah, there are hundreds of CAs out there. People could get their SSL certs from any one of them and MITM all your supposedly secure web traffic.

And plenty of ISPs will do exactly that, if you give them half a chance.