CA settings within Control Plane

my understanding of internal CA is as follows:

  • single, self configured CA is running in or at least is controlled by istio-system namespace (istiod)
  • all envoy sidecar proxies request certs and get CA signed certs on daily basis

is it possible to implement 2 or more CAs and maintain (disjunct) sets of envoy proxies connected to these CAs ?