Comment by tgma

> Is it not obvious that not every global .com website owner wants to use only have the choice of US-run CAs

The major browsers are all US made though, so in the end there is an implicit trust on US vendors, even deeper than the trust on CA.

> It's also not at all a given that website owners would prefer the national CAs

The suggestion is to have a few major ones (LetsEncrypt) be able to sign everything like today but restrict the others. You can still choose to use the US one, just like you basically use CT logs from the US vendor today.

--

In practice, DNSSEC/DANE based solution may be the practical path forward along this line.