[fomine3]

Issuing CA cert with Name Constraints is good, but end user should recognize the certificate is constrained to their domains or not.

[midasuni]

The end user should be able to choose the domains the root is valid for - regardless of x509 name constraints.