Clients have no way to indicate what CAs they trust, so my infrastructure has to just present a certificate and say "Here I am" So now if Google go ahead and d

Clients have no way to indicate what CAs they trust, so my infrastructure has to just present a certificate and say "Here I am" So now if Google go ahead and distrust Symantec CAs, I need to duplicate that infrstructure (or at least the configuration at load balancers, etc) - this leads to all sorts of complexity.