This also reminds me of SGC certificates where browsers only trusted a limited number of roots.