There’s a key difference. With a CA, you have to trust each and every CA. If some CA goes rogue, it compromises everything. In contrast, with a BDB instance (eg IPDB), you only need to trust the caretaker nodes collectively (eg trust an arbitrary majority). Even if some go rogue, you’re ok.