There have been cases of breaches at various root CAs, including Adobe products; the Zeus Trojan that had a forged Microsoft certificate; a Dutch government cert breach that impacted Facebook, Twitter, Skype, Google and also intelligence agencies like CIA, Mossad, and MI6; A breach at ANSSI, the French Cyber Security Agency.
Then of course there's the recent SolarWinds debacle that should kill this notion once and for all.
https://resources.infosecinstitute.com/topic/cybercrime-expl...
There have been cases of breaches at various root CAs, including Adobe products; the Zeus Trojan that had a forged Microsoft certificate; a Dutch government cert breach that impacted Facebook, Twitter, Skype, Google and also intelligence agencies like CIA, Mossad, and MI6; A breach at ANSSI, the French Cyber Security Agency.
Then of course there's the recent SolarWinds debacle that should kill this notion once and for all.