It’s a lot more complex than you may realize. We have a transparency solution known as Certificate Transparency. For a “verisign” issued cert to be trusted in the browser, there must be an append only record of the cert stored in a blockchain. If Russia overrides a local trusted root, all bets are off an CTlog is not used. You can trust the CA because malicious issuance is a death sentence. And we have logs for all eternity.

Hmm I had never heard of Certificate Transparency, looks like its a relatively newish tech added onto how SSL/TLS certs work. It seems only Google Chrome & Safari require SCT chains (not used by Firefox). Maybe I've never heard of it because I'm a Firefox user? You mentioned blockchain, does that mean there is a public blockchain for these Certs? I didn't see that mentioned anywhere but it does seem like blockchain features overlap with the desired features of "Certificate Transparency".

There is a blockchain ran by a bunch of interested third parties for CT, yes.

The block chain is different for each CT operator, it just allows you to validate the issued certs.