multirootca security issue

I have a multirootca setup with two ca's, ca1 and ca2, each of which has one authentication key defined in the ca's config. multirootca was built from source on CentOS 7 using the master branch.

`
git log -1
commit ea4033a214e73d353084d61c244b9ca1e9a727c4
Author: Christopher Broglie
Date: Thu Nov 1 17:30:07 2018 -0700
`

A gencert request works as expected, provided that a valid authentication key is supplied. However, an authentication key defined in the config of ca2 can be used to retrieve a cert from ca1 and vice versa.

I was expecting that each root would only provide a certificate for authentication keys defined in its own configuration.

Is the behaviour observed a security flaw or expected behaviour?