Letsencrypt doesnt issue certs to Iran, Syria, Cuba, Sudan et al.
We comply with U.S. sanctions by not issuing to entities on the SDN list, but that doesn't prevent us from serving the vast majority of people in those countries.
https://community.letsencrypt.org/t/certificates-for-us-sanc...
When I registered my domain I got WHOIS protection and then LE just made sure I owned the domain. There was no asking about who I am or where I reside or what lists I might be on.
https://www.treasury.gov/resource-center/sanctions/sdn-list/...
Some entries have specific domains associated with them, but we are obligated to not serve any domain directly associated with (i.e. controlled by) an SDN entity, not just those listed.
If we become aware that we may be serving an entity on the SDN list (often via someone emailing us) we have to conduct an investigation which may result in termination of service.
What are good non-US CAs?
It's not LE's fault or anything they can do about, but there's plenty of reasons to have alternative options.
Or better yet, is there a way to start a decentralized organization itself so that no jurisdiction has absolute power over it?
CAs exist solely because you CAN trust them, otherwise what's the point? We'd just have every site self-sign and let the users choose who to trust.
That's the idea, but in practice, I don't really trust the vast majority of them.
Of course there's a question of where you should put such a thing. Even Russians apparently don't find the idea of a Russian CA trustworthy (they expect that Putin would have his thumb on it, and who am I to argue?), a European CA is certainly not free of American influence, so where would this alternative be based? I don't have a good answer.