&gt; it can shitcan the CA, either evicting it from the trust store or placing onerous restrictions on it<p>None of which prevents it from happening again with another one of the 300 CAs whenever another government gets antsy.<p>&gt; If the government-controlled super-CA that runs .COM misbehaves, we have no recourse.<p>As a westerner I trust the super-CA that runs .COM 1000x more than some random CA in China or Iran or whatever. But even that&#x27;s beside the point. If they abused their trust (which would be caught by CT) <i>the whole system would collapse</i> because, like you said, you can&#x27;t shitcan .COM. Everyone would move to keypinning and&#x2F;or a decentralized blockchain-based DNS solution and we would gain real security.