Google, Apple, or CCP. Problem solved.

I mean, the actual implementation will be that CCP signs Google DragonFly Global Root CA cert, and Apple runs Google signed firmware, but those are just minor implementation details.