And that's how the CA system is actually supposed to work. You add to the trust store those entities you trust rather than those that are trusted by the browser makers...