No, it would require them to add their cert on the intended machines under their control. The only reasons they would need the trust of all browsers and OS's ar

No, it would require them to add their cert on the intended machines under their control. The only reasons they would need the trust of all browsers and OS's are subterfuge and laziness. They should not be globally trusted to issue certificates.