If you choose not to cross-sign, how would a browser make a valid chain if ISRG Root X1 isn't valid in that certain client?