> "There were no end entity certificates issued"

Isn't the problem that anyone can/could issue end entity certificates with those certificates as "parent"?