It's almost like the threat models for CA and leaf certs are different.