We're kidding ourselves, totally kidding ourselves, that we have made the CA system "manageable" by allowing CAs to sell subsidiary CAs to other companies. Yes, those certs aren't cluttering up our 2 terabyte hard disks. That's a bad thing, because they're still out there, and they work whether your browser tells you about them or not.