[brewmarche]

If scoping were actually viable, public CAs could also sign your private intermediate CA with a name constraint and it would be trusted everywhere.