And he is not wrong about that. The HTTPS/SSL infrastructure is byzantine and less concerned with actually encrypting information, but establishing trust that whoever you as the browser are communicating with is in fact the server that you expect them to be. This is not an easy problem to solve...

For the longest time, this introduced the ecosystem to professional certification authorities, which are essentially profit-oriented organisations that gauged prices.

Let´s Encrypt made some of the situation slightly better, opening up small websites to encryption, but you are still dependent on an external CA and the goodwill of the browser manufacturer to distribute their root certificate with their browsers.