Also certificate authorities are largely opaque corporations and there is no community verification of actual trust between a community of people sharing content with each other.

It is not unheard of for a CA to get hacked or issue fake certificates to aid hackers.