I have an even more naive question: if EU wants a secure and well-overseen root services operator, why don't they spin up their own one? They can do whatever they fancy for their own money.