That would strictly require that all TLS clients correctly handled intermediate certs with a scope limitated to a few hardcoded second level domains.

Right now there's barely support for limiting a root CA to a single TLD...