... is not required in order to build a public-key infrastructure (PKI).

... can delegate its role to another CA.

... typically has its public key(s) built-in to the software (e.g., Chrome, Firefox) so that the certificates it signs can be automatically accepted.

... must be a root CA in order to sign end-entity (EE) certificates.