and, if you have a compelling reason, you can convince other CAs to cross-sign your certificate, like LetsEncrypt did: https://letsencrypt.org/2020/09/17/new-root-and-intermediate...

Browsers control what they trust, too, and can remove roots if they’re behaving poorly: https://blog.mozilla.org/security/2011/08/29/fraudulent-goog...

That is to further your point: there is no central decision-maker