Actually it does do that, you can trust multiple CAs in a single instance and even write firewalls scoped to CAs.