The only thing which I questioned myself and did went to research more about those new certs which will be used since Digicert has had the only one the cansignhttpexchanges=yes and a 1 year period valid. Was interested if the new Google certificates would have if too → as far as I can see, they do have it:
0 issue "pki.goog; cansignhttpexchanges=yes"
0 issuewild "pki.goog; cansignhttpexchanges=yes"
Due to the Google AMP project and documentation from Digicert:
… which throwed me back to my first topic on this forums 3 years ago (I think) about AMP Real URL (back in those days Ampersand) → Ampersand not clickable? 
as I was trying to implement and get this working on Nginx, but Cloudflare offered a “single-click” solution to this 