In a way it&#x27;s broken for the same reason than the banking system was: too big to fail. So many websites rely on a few CA that we can&#x27;t allow to fail, otherwise we break the internet.<p>I wonder if we shouldn&#x27;t adopt a solution similar to what was adopted for banks: a plan for orderly failure. Having a protocole, at least for DV certificates, to easily switch all your website to another CA. All CA would have to implement the same API, and all web servers would be able to consume that API. The same API would be used for auto-renewing certificates. Effectively generalising let&#x27;s encrypt for commercial certificates.