Is not a issue with the new ca_bundle as far as I see. And the behavior does not seem very dangerous to me, since the only way to have a website be verified is to use the same CA (DigiCert High Assurance EV) as we use.

I'll experiment some more going forward and should add a comment in the code.