It would make more sense to make the CAs opt-in. Want to trust CAs for US and IN? Opt-in to both.