There are already points of centralization at the domain registrar and DNS layers.<p>That was a major (really <i>the</i> major) basis of the fight against SOPA--it would have required ISPs to interfere with DNS resolution as a way of shutting down serial copyright infringers.<p>And the U.S. federal government can already seize domain names for some reasons.<p>So, the question is: does the value of pervasive over-the-wire encryption outweigh the risk additional centralization via CAs? Right now I think it does, but that is in part because I believe that the CA infrastructure itself will improve over time.