We don't even have a centralized authority for x509 in browsers, and that's the closest you come to being correct — there are still many CAs and multiple groups coordinating which of those are trusted, and private CAs are common even up to millions of users.

GPG has been around since the 1990s with the web of trust being entirely decentralized and while I'd be the first to say there is room for improvement there's no way that's anything other than decentralized.