Agreed. Any subsidiary CA should be meeting all the requirements imposed on the root CAs - and if they are, then they could simply be included in the browser r

Agreed. Any subsidiary CA should be meeting all the requirements imposed on the root CAs - and if they are, then they could simply be included in the browser root programs in their own right rather than paying another CA for a sub-CA cert.