But the two roots will not use the same trust anchor. Have you considered the costs and compatibility issues of coordinating the management and rollover of private keys for multiple roots? My guess is you have not.