I'm looking for an overview and requirements on how this will work... including
Root CA selection (across the platforms)
What does the request look like?
How does the payment "flow" look like?
How are Root CAs selected?
Root CAs are selected from this Mozilla root CA list. Although I haven't seen anything to verify this, but I hope there is a way to account for Certificate "extended key usage" in the PKI hierarchy.
What does the request process look like?
No GUI screenshot of this process is available (yet), but a workflow of the process looks like this: