Given that there's already a self-signed ISRG Root X1, what would be the purpose of having an ISRG Root X3 cross-signed by ISRG Root X1? Such an ISRG Root X3 would require that either the self-signed ISRG Root X1 or the cross-signed ISRG Root X1 be in the user's trust store, which effectively causes ISRG Root X3 to simply extend the chain with no real benefit.
5 Likes