So like, the cable company now controls the certs for most consumers?

shudders

Yes. This is basically the DANE pitch. Subtextually, supporters argue that two big shifts will immediately happen:

(1) We're also rearchitect the way all DNS is done so that every lookup from every phone and laptop is fully recursive, so that everyone validates DNSSEC chains instead of relying on the AD bit that cable company DPI devices switch off.

(2) People will lose all attachment to their current domain names and simply migrate to TLDs that have policies they agree with, rather than .COM and .IO, which are under the demonstrated de facto control of the NATO IC.