I'm not sure about this specifics here, but this is a feature offered by some CAs: They create a new intermediate, signed by their root, just for you. You the

I'm not sure about this specifics here, but this is a feature offered by some CAs: They create a new intermediate, signed by their root, just for you. You then get to ask that CA to issue certs for you - and only you. You don't have total control over the intermediate -- as you suggest, that would let you mitm everyone. But by having an intermediate that you effectively control, you could have apps/devices/etc that trust only that intermediate (via pinning, HPKP, etc). That prevents a bunch of the possible downsides of using the public PKI (eg, a CA mis-issuing a cert for your domains), the downsides of pinning a leaf cert (because you can always issue another one off your intermediate if you change names, etc), and the downsides of a private PKI (because stuff that trusts the public PKI works too)