Does this generate root CAs with NameConstraints[1] set? Because otherwise, the root CAs could issue a trusted cert for _any_ domain on the internet.
This way the only possible certificates that can ever exist are those created during setup. After that nobody can sign more certificates because the private key needed doesn't exist any more, so you don't need to worry about constraints (which can have compatibility problems e.g. that's why Let's Encrypt X3 and X4 exist instead of X1 and X2 these days)