CAs don't make this problem go away; they just shift it to a central "trusted" party. With the CA model, we're assuming that Let's Encrypt isn't being MITMed.