I ran the technical side of a global CA for 5 years (left the industry early this year) and I can tell you that while validation (outside of EV) is relatively simple, the technical/legal/audit aspects add up to a significant cost.<p>If you want to run a CA you need to obtain sufficient funding (on an ongoing basis, these aren't all one-time costs) to do things properly. Properly means expensive audits, expensive HSMs, expensive secure rooms with multi-factor authentication to enter, auditing of all actions, long-term record retention, reliable and performant OCSP responders, endless documentation (DR, secure hardware lifecycle policies, etc), being an active member of the CABForum to drive your agenda and keep abreast of changing industry requirements, and much, much more. Of course, by doing so you are attempting to upend a multi-billion dollar industry, so expect a political fight with the CAs and potentially the browsers as well...<p>These problems are part of what lead people to prefer replacing the industry (DANE, Convergence, TACK) over building a non-profit CA in the existing model. Of course, replacement comes with its own huge set of obstacles.<p>All that said, if you're a company with a bunch of money you want to spend on this problem, let me know. I am willing to lend a hand.