Ask HN: Why do foreign CAs have the power to make .com SSLs?

This is the second or third time in recent memory some foreign CA has been caught with a bad SSL. Why is a .nl organization able to produce .com SSLs? In the world of domains a .nl registrar can only make .nl domains, but in the CA world they can make whatever TLD they like? That seems like a fundamental problem here. Can this be fixed or addressed somehow?