@bkim @agwa google.com sets a CAA record that explicitely forbids issuance by anyone except Google's own CA. A public trusted WebPKI CA is required to check this.
In the end it just adds to the list of problems that where already mentioned in the two unsuccessful inclusion requests to Mozilla. And it seems Microsoft does not care.