Basically, yes.

> Consider this ... what if I wanted to introduce doubt that X is really verified, and thereby hurt their business. How can you avoid me doing stuff like that? Besides harsh laws of course.

By not trusting you.

Right now, what happens is the browser and/or OS vendor determines a set of certificate authorities to declare "trusted", and all certificates they issue are simply assumed to be valid.

Instead, we could require, say, three signatures, each from different authorities, to invoke the normal "this is a secure connection to a properly-identified website" behavior.

But each of those authorities was still determined by the vendor to be trustworthy. It's still going to be the likes of e.g. VeriSign, Comodo, StartSSL, etc.. It's not going to be you.