The idea that only members of the CABForum can run CAs is silly, especially when (a) many of those organizations are in fact beholden to governments and (b) some of them have actually sold root CA certs.
There is no technical reason the ACLU should not be able to run run its own trust store, certifying alternate CAs that it is confident aren't corrupted, and revoking CAs when certificate pin errors make it clear that they have been. The UI to make that happen is very simple as well.
My issue with things like distributed ledger verification is that TLS's problem isn't the crypto. The crypto should be kept boring; we're barely holding the crypto together as it stands.
The problem with the TLS security model is browser UX. We can and should leave the protocol alone.