Some browsers do restrict CAs, see e.g. <a href="http:&#x2F;&#x2F;googleonlinesecurity.blogspot.ca&#x2F;2013&#x2F;12&#x2F;further-improving-digital-certificate.html" rel="nofollow">http:&#x2F;&#x2F;googleonlinesecurity.blogspot.ca&#x2F;2013&#x2F;12&#x2F;further-impr...</a>