There is some chatter about a CA mis-issuing a certificate for 1.1.1.1. https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/SgwC1QsEpvc/m/0V_VMV7uAgAJ
This CA (https://crt.sh/?caid=201916, only ~300 certs) is only trusted by (1) the Microsoft root program, and (2) the eIDAS QWAC trusted list.
MS has not been actively managing their root program for years now, and the EU wanted to push theirs on browsers with much better ones.
