Unfortunately, a child can take over an unpatched computer using public exploits.

Please explain your comment about how key signing ceremonies stop people from being bribed. The creation of those keys creates a root of trust but doesn't stop leaf certs from being generated.

Sure it doesn’t stop certs for certain domains but again it feels handwavy to say someone can just as easily do these things. Theoretically yeah. But to be a publicly trusted CA, the kind of processes you need to have a pretty extensive.

Still, there are hundreds of publicly trusted CAs so the chance for exploitation is higher.