The CA during the father or mother area doesn't have permissions on the userCertificate property around the people in the kid area. In the event the CA is uninstalled, only the pKIEnrollmentService object is eradicated. This prevents customers from seeking to enroll from the decommissioned CA