You have got a lot of useful replies but it seems no one addressed this line in your question:
I just read about the 7 people who hold the ICANN database key
This is completely not related to any fact.
First there is no "ICANN database". As explains in other replies, ICANN does not have an operational day to day role in domain name operations. When you buy a domain name, you exercise various services at registrars and registries, but ICANN does nothing there, it just have a "financial" role and as regulator, accredits companies, etc.
When speaking about keys, I think you are referencing articles such as https://www.theguardian.com/technology/2014/feb/28/seven-people-keys-worldwide-internet-security-web and many others. They are mostly very sensational, including in their title, for no reason except selling papers.
They are trying to explain complicated technical concepts (around DNSSEC, see below) but do so in so many gross over simplifications that the end result is completely meaningless.
Since it is not the core of your question, let us here just try to summarize the issue:
- to secure DNS resolution, a new protocol (an extension in fact) was invented, which is called DNSSEC
- DNSSEC uses cryptographic keys (the same kind of the ones used for certificates when you browse HTTPS websites, etc.) to authenticate DNS answers so that a resolver can detect if there is an attack on a domain name
- DNSSEC works with a chain of trust, exactly like in the HTTPS world with CAs; this means that each level of the DNS tree has a set of keys
- so that extends to the root (
.) which is the mother or father of everything, starting with TLDs
- the root of the DNS tree has keys that needs to be changed twice per year; this is a policy issue, not a technical one; it is a compromise dictated by the wish to both change cryptographic materials to reduce the window of opportunities for attackers, and also to have "ceremonies" frequent enough so that people are well-trained for them, including if/when it will be needed to conduct them in an emergency
- the ceremony taking place twice per year to change these keys involves many people and many processes, with a lot of auditing
- to make it short, no the Internet is not at the mercy of 7 people that could do anything they want and disrupt things. Each one by themselves have basically no power at all. They just need to remember their passwords and be able to be at some specific location once or twice per year to participate in the ceremonies, with many other people attending it.
Also these people are not paid by ICANN, at most their travel costs are reimbursed.
If you want a non sensational description of things and a technically correct one, you can read this article: https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/
As for the key holders specifically you will be able to read this:
There are only 14 available Crypto Officers in the world (7 are affiliated with each location), and at least three of them must attend the ceremony.
Each of these participants can only perform certain parts of the ceremony. Their roles are divided in a way that ensures less than a 1:1,000,000 chance that a group of conspirators could compromise the root-signing key, assuming a 5% dishonesty rate (yes, that’s formally in the specification) amongst these individuals.
The first four of these individuals are ICANN staff members, while the three crypto officers are trusted volunteers from the Internet community. Verisign also plays an important role, as they are the root zone maintainer responsible for generating the root zone-signing key that is signed during the ceremony. In addition, the entire procedure is audited by two Big Four auditing firms that are not associated with either Verisign or ICANN.