In this analogy I think it would be more appropriate to call them a lockmaker, and a lot of gates have been using this lock. Finding and fixing every lock is where the effort comes from, and some locks may not be found for years to come.

This lockmaker analogy fails to capture one critical aspect: the failure of one CA breaks the security of everyone, even if they did not use that CA's "locks".

This is why I went for a "wall with many gates" instead; any bypass makes all gates redundant.

All analogies break down at some level; the main goal is to clearly communicate the most important ideas.