Comment by account42

Unfortunately due to the insane design of web PKI you can't choose not to use them as every CA trusted by the root stores can sign certificates for your domain.