Actually true root certs when evaluated by the browsers will have their name constrains within the root certificate themselves ignored. Modern browsers do resp

Actually true root certs when evaluated by the browsers will have their name constrains within the root certificate themselves ignored. Modern browsers do respect name constraints of intermediate issuing certificates.