[xg15]

This sounds a lot like the "increasing hostility for non-web usecases" line in the OP.

In theory, Chrome's rule would split the CA system into a "for web browsers" half and a "for everything else" half - but in practice, there might not be a lot of resources to keep the latter half operational.

[Ajedi32]

In practice this might just mean that applications designed to use web PKI certs start ignoring the value of the extendedKeyUsage extension. OP says Prosody already does this.

[ameliaquining]

Well, if libraries like OpenSSL check extendedKeyUsage by default but provide an option to disable this, then most apps benefit from more stringent security, but ones like Prosody with unusual use cases can continue to make those use cases work. That doesn't sound like the worst thing in the world, necessarily? (I'm not sure how Prosody actually implemented this, though, or whether OpenSSL actually works that way.)