The bullshit the CAs pull never ceases to amaze me.
Could be public, could be private (I'd prefer private, since that would make resiliency, competition & experimentation more likely).
The problem is that a single entity can vouch for each site, so if you don't want to trust it, you can't validate the site at all. Moxie's Convergence[¹] proposal - like Carnegie Mellon's Perspectives Project before - avoids this problem by allowing many entities to vouch for the same site.
Most certs are just money printing machines for the orgs in charge of them and I am not surprised they would want to fight back against LE.
Yet somehow, the PCI SSC accepts their scan results as actionable for Level 1-3 compliance.
While I'm sure there are CAs who aren't as egregiously bad as Comodo, it's hard to get around the fact that they basically shouldn't exist as a class, and any CA that isn't working to put itself out of business is sort of hurting the Internet ecosystem.
Another reason to use distributed identity.
Donated to Let's Encrypt.