> the real control lies in browsers and operative systems in which certificate authorities are trusted

Wasn't Let's encrypt a Mozilla child ?

The real control lies at who defines what is trusted.