Comment by Ajedi32

The root certs may have signed other intermediaries that are still trusted.