I'm not sure how'd you accomplish this without requiring an EV cert, which is expensive and time-consuming to get, right? I guess manually maintaining a list of free CAs like Let's Encrypt? Idk, I'd never pay for a cert I'd have to manually update where my LE certs are all automatic.