Trust isn't that centralized. Thanks to Certificate Transparency, a CA cannot issue a certificate that will be accepted by Chrome or Firefox without the site owner being able to detect that.
Strong players in the web space are also trying to centralize DNS resolvers, using similar arguments.