Mozilla's latest bundle has 148 root CAs in it: https://ccadb-public.secure.force.com/mozilla/IncludedCACert...

So "decentralized" in the sense that there are more than one, but it's not some hierarchy-less free for all where anyone can attest to their own identity and trustworthiness and the network just automatically accepts that.

Sure it is. You can easily create your own root CA and have others trust it.

I don't really understand the complaint because you literally can attest to your own trustworthiness through your own cert.

Having others trust you is a taller order. Obviously that isn't automatic.

> decentralized reputation through cert validation?

Certs are pretty dang centralized.

Also, Your second sentence needs a bit more fleshing out because it doesn't follow.

Certs are certainly decentralized. You can create your own root, share them, etc. There a several highly trusted roots that are chosen by OS makers, not centralized. Some roots are quite big but what part is centralized?

Chain of trust is a decentralized reputation protocol and we use it frequently and effectively.

While it's not strictly centralized, as in, there's no single root, the sets of root certs in usage are extremely similar. There are only a handful that matter, and they overlap significantly because they share choices: Windows, Android, Apple, Firefox, various Linux distros.

A contributing factor is that the culture that grew around them makes it uncommon to be able to manipulate your own certificates. If you set up a Web page with your own root cert, you can be sure it will never grow.