This is a general question not related to any particular website or a CA (Certification Authority).
We all know that HTTPS is an encrypted protocol, but one that relies on CAs issuing digital certificates to websites with due regard. Now, its theoretically possible for a CA to issue a proper certificate to a malware hosting site, is it not? In other words, CAs are the weakest link in the security chain of HTTPS. If that happens, then what are the implications?
Additionally, we also know that the data we browse on the internet passes through multiple hops and nodes (your ISP, the website's ISP, caches and proxies like CloudFlare, etc). Suppose if any of these entities in between got hold of the website CA certificate (public and private keys), can they capture the data being transferred? If yes, then what is a good alternative to the present HTTPS system?
There is another aspect of concern with HTTPS, though it may not be related to any CAs. Nowadays, every now and then you get laptops and other gadgets that come pre-installed with dicey browser certificates that allows a phishing site to be opened without any regard (Dell and Lenovo models had such cases recently, I don't have any links but you can Google them). Again, this can also be deemed as a weakness of the HTTPS system.