In a more convoluted scenario (cross sign) a server can really send you two (or more) chains so I'd take that "SHOULD" with a grain of salt. For example, Let's

In a more convoluted scenario (cross sign) a server can really send you two (or more) chains so I'd take that "SHOULD" with a grain of salt. For example, Let's Encrypt Authority X3 is signed by both ISRG Root X1 (their own root CA) and DST Root CA X3. The server could send you: 1. Server cert 2. Let's Encrypt Authority X3 (Signed by ISRG Root X1) 3. Let's Encrypt Authority X3 (Signed by DST Root CA X3) Combined with: 4. ISRG Root X1 5. DST Root CA X3 If the client trusts 4, then it could form a path of 1-2-4. If it does not but trusts 5, then 1-3-5 would be viable.