Part of the idea is that browsers just won't even bother looking at the CA cert as a trust root unless the IP is in the private network IP address space. So it

Part of the idea is that browsers just won't even bother looking at the CA cert as a trust root unless the IP is in the private network IP address space. So it will look for a 10.x.x.x IP, but ignore it for *.google.com.