[NovemberWhiskey]

X.509 Name Constraints are widely supported in browsers at this point - ref. https://bettertls.com - at least for DNS SANs and for the common cases.