The intermediate CA issue is failarious. But I keep waiting for someone to fix the fact that any root and its intermediates can sign CSRs for any domain. It made sense in the 1990s. It stopped making sense in the 2000s.
And there’s this.
bugzilla.mozilla.org647959 - Add Honest Achmed's root certificateRESOLVED (kathleen.a.wilson) in CA Program - CA Certificate Root Program. Last updated 2026-04-24.