The WebPKI is drastically different than it was in 2012. Browsers all run their own root program. Certificate Transparency was not only launched (in 2013) but is now effectively mandatory for all CAs. Some of the largest CAs in the ecosystem were surveilled, had misissuance detected, and were put to death by the browsers. In 2010-2012, companies were still being sold CA:TRUE certs so they could intercept traffic on their own networks; now that would get your whole signing CA burnt.

It's OK not to pay any attention to the WebPKI! It's a whole specialized thing. But that's what you'd have to do to reach the conclusion that "not much has changed". The years following 2012 were the most momentous in the history of PKI.