Let me rephrase. What if every cert authority might do it to some company (different companies for different cert authorities)

How would you even know if they did?