They'll need to pass a webtrust audit, which covers how they handle their key material amongst others. Additionally the Microsoft, Apple and Android roots have their own extra requirements added.
It's almost as if money is more important than key management practices.
Or the CACert website itself.
Always seemed to me like some kind of joke.