[tptacek]

Does Safari grok Name Constraints yet? I thought it didn't.

[agl]

I'm not sure, but in the back of my mind I don't think that it does. I've agreed to write about this stuff for the Web PKI Working Group so I'll need to do a survey of the various capabilities at some point.

[rmhrisk]

not currently, their move off of OpenSSL to their own libraries makes this more complicated for them to do but I am hopeful they will soon.

Here is a summary of where clients were a year ago, opera has support now so its slightly out of date - http://unmitigatedrisk.com/?p=24