Trusted Root Restriction
Only a certified commercial CA organization or certified independent organization can achieve the status necessary to own and operate the TRoot CA in a Trust Centre.
Trust Centres are Commercial CAs and are usually operated by accredited TTP organizations. The TTP is an organization that has been certified in accordance with international standards as being suitable and capable of issuing Digital Certificates. To attain the status of being a TTP, the organization must have at its disposal a secure data centre that conforms to the WebTrust or similar Standards (an internationally recognized authority that certifies TTPs).
This typically includes that the data centre meets the same military standards for the physical facilities, personnel, procedures, practices, security controls and allocations used when storing nuclear missiles and is therefore highly secure. Once the TTP has been certified and its Root Certificates accepted by the major browsers, they can issue Trusted Certificates.