It's also a LOT easier to recover from a key breach - you expire the old *.com certificate, and publish a new one under the root. No problem. The root key, of course, must be VERY carefully guarded - but since updates are infrequent, this can happen on an isolated system with no network connection (or even more paranoid systems, such as secret sharing schemes...)