They aren't trusted-third-parties, they are centralised-vulnerability-parties. An article in Financial Cryptography argues "why the browsers must change their old SSL security model".