[cpach]

I guess we could have some kind of web of trust system instead. But are there any web of trust systems that actually work in practice?

[Natanael_L]

Allowing multisignature models would at least drop the single point of failures, by being able to require verification from multiple CAs. In combination with certificate transparency and DNSSEC+DANE it would add much stronger security.