CAA is a hint to honest CAs to ignore requests to issue certificates for your domain (unless they are explicitly allowed). It does absolutely nothing about dishonest actors with access to trusted keys.