Web of trust required a lot of work by users and was pretty bad in practice. This isn't that.

This would effectively be the same "root CAs come pre-installed" but they would be notaries rather than root CAs, with a predefined trust policy (maybe minimum of 2 notaries per leaf certificate)

Users would still just see a green lock icon same as before, no action needed.