Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.

Right but there are probably 100-1000 important domains and a long tail of less important ones