Really?

I was under the impression that when a new CA starts operating, they get their certificates cross-signed by older CAs, to ensure their certificates work on older devices? Lets Encrypt did something like that [1] - although they started operating in ~2015, their certificate chain started with a root valid from October 2000 to October 2021 [2]

After all, many website operators want users to be able to connect even if they're using prehistoric Android versions.

You can access Wikipedia with Android 4.4 which was released 13 years ago [3] (although apparently not on the slightly older Android 4.3)

[1] https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted [2] https://scotthelme.co.uk/lets-encrypt-old-root-expiration/ [3] https://www.ssllabs.com/ssltest/analyze.html?d=en.wikipedia....