In retrospect, not having a tiny competency check may have been an oversight.

That really depends how you define "trusted certificate authorities".

If you're talking about root certs then it's almost 350 currently trusted by at least one major operator.

If you include intermediates, you're talking more than 3,600!

Certificate transparency requirements effectively take the power away from certificate authorities.

They instead place the burden on individual webmasters again to actually verify that nobody has been falsely issuing for their domains. There are also some new vulnerabilities about CT logs who might be malicious.

How are they trusted if they can just generate any key they like in their back room?

Correct, we only need zero.

or, perhaps you need more so that one being stupid doesn't effect so much.