If you're the authority you can restrict the certificate authority to a given set of domains, but that's if you're the authority. I'd like browsers to give use

If you're the authority you can restrict the certificate authority to a given set of domains, but that's if you're the authority. I'd like browsers to give users control over that, to trust a CA in a limited fashion for only a subset of domains without trusting it to MITM the web.