Well actually I think you mean... no just kidding. Thanks for the correction. I thought CAA records would also tell clients if a trusted root was also trusted for that domain.