Zero would be hard but we could have signed CA cert put into DNS record and from that the org itself can create the certs for that domain.

Then at the very least one of the CAs leaking isn't automatic compromise, as leaking the key still doesn't make you insecure, that would also require intercepting and changing DNS records