Is that supposed to reassure me, or reinforce my point that all of this is a huge mess that's probably trivial to compromise?

That's up to you!

I'm a PKI skeptic who's now working in PKI and my impression is that everything is getting better quickly -- partly thanks to stepped-up scrutiny and enforcement on the browser side, led by Google.

You could look at the "getting better quickly" part and be happy about that, or look at where we started from and be unhappy about that, maybe like several other things in the world.

> all of this is a huge mess that's probably trivial to compromise?

That's a bold claim. I think you should prove it otherwise it's just FUD. By prove it, I mean perform an exploit and documented it. That's the only way things get better.

It's not FUD when you have a list of incidents (https://community.letsencrypt.org/c/incidents) and it's not FUD just because I don't have 0days sitting around. If this is just the incidents from one CA, and assuming this is an example of best effort, there would naturally be many more, and possibly worse, exploits gone unnoticed on the hundreds of other CAs.

Only three of those incidents were described by LE as resulting in misissuance under its CPS:

https://community.letsencrypt.org/t/blocklist-incident-novem... https://community.letsencrypt.org/t/2018-05-18-caa-tag-value... https://community.letsencrypt.org/t/caa-check-incident-decem...

Of these, I believe that none were issued to entities that didn't actually control or operate the sites described by the certificates.