Precisely. This should not be a thing that can happen on a page that allows one to request and receive certificates rooted in trust stores.