This should be one of those things that should be an quick EU win.
Running Let's Encrypt is $3-4mill a year, the EU probably uses that on pencils.
The EU could easily bootstrap a Let's Encrypt competitor if it truly cared about removing dependencies on US based entities.
Yes, but EU would have to convince Google and Apple to get a new root certificate to browsers.
Not really. They just have to convince an existing CA that cross-signing their CA won't make Google and Apple mad.
Cross-signed roots are common. Just takes money and maybe audits, but it's the same audit they'd need to get in the browser root stores anyway.