At least for use in Kleopatra it makes sense to allow filtering for certificates issued by certain CAs. We used to have some support for qualified signature certificates in gnupg and that might be the base for a more general mechanism to mark CAs.