It's not that they need to be open-source or not, it's that their user interface is absolutely awful.

You can set up your own CA but you can't sign for domains unless you're in the proper chain. The ones holding the keys for these are the big providers.