Your claim also only applies to the f'd up CA bundle that browsers ship by default, it's not a property of SSL/TLS.