Web PKI doesn't work like you think it does. I can use eMudhra's private keys to forge a cert for your website. You don't have a choice in this.

Worse yet, why is that CA even part of the Root CAs shipped on all the modern devices?

My trust in those vetting the CAs is completely broken now.

You might have heard of this "sovereignty" movement: sovereign OS, sovereign cloud, sovereign AI?

One man's "little known company with no cybersecurity muscle" is another one's "sovereign certificate infrastructure."

It mostly does not matter. They don’t have your private key, and EVERY trusted CA can miss-issue in your name, regardless of who you pick.

That’s sort of the problem the CA forum (badly) addresses. The consumers of the CAs are not specifically exposed to failures of the CA they choose.