Running a commercial CA is not for amateurs or those with a weak stomach. It's a LOT of work, and costs a LOT of money. The operational security requirements are VERY high in order gain the trust of your customers. The physical security alone is prohibitively expensive for most companies. Man traps, secure server rooms (REALLY secure), biometrics, etc. Additionally, there are the technical security requirements. Smartcards, hardware security modules (HSMs) for key storage, and so on.
In order to gain the trust of the browser manufacturers, your PKI has to be certified by a recognized standards body. This is not easy, and it is not cheap. Every aspect of your operation and infrastructure needs to be documented, and you have to stick to it. No relaxing on the rules.
Practically speaking, you're talking about an expense on the order of a 7-figure expense to get things up and running, with additional costs for certification, etc.
SOURCE: I've worked on the largest PKI in the world (Fed. Gov't) as well as the largest commercial CAs for the last 14 years.