The CA system is broken and browser vendors try to deal with it. Deal with it = trade off between security and (in)convenience.