The check should probably be done for intermediary CAs though? Right?