I wish I could set my browser into a mode where CAs are an opt-in.

I enable this setting and at first I can't go to Google unless I enable Google's CA. The go to Amazon and get the warning, get displayed what I will be enabling and have the ability to use Google to search if I will trust them. So I enable DigiCert Global CA in order to use Amazon, and ask myself why the hell I need to trust that 3rd party.

And so on. This way I would never have Hong Kong Post Office's CA enabled in my browser.