I vaguely remember when talking to some ICANN people that there were talks of a system to restrict the domains which the individual root-CAs were allowed to sig

I vaguely remember when talking to some ICANN people that there were talks of a system to restrict the domains which the individual root-CAs were allowed to sign for. I don't remember what happened to that.