Fun fact: one of the "independently-operated and audited subordinate CAs" that is exempt from this is, yep, you guessed it, Google. They've recently acquired a

Fun fact: one of the "independently-operated and audited subordinate CAs" that is exempt from this is, yep, you guessed it, Google. They've recently acquired a GlobalSign root and are in the process of getting their own roots added to trust stores, but I imagine they'll want to keep chaining back to the widely-trusted GeoTrust root for a few more years. (IIRC Apple is on that exception list too.)