Did a CA once accidentally sign a raw CSR that requested to itself become a CA? It seems like I remember something like this, but I couldn't find evidence. Anyway, that's one reason for the CA to be very careful what values it pulls out of the CSR.