wouldn't they have to be an emudhra customer (their ssl certs signed by emudhra)?

If I understood correctly, emudhra was able to issue certificate to any website.

Therefore if some device trusts emudhra root certificate...