The nature of (user friendly) CAs requires centralization. You can always sign your own certs and distribute them -- nothing is stopping you aside from a poor user experience.