I haven’t researched this fully yet, but I believe that this is a nuance of x509 and certificate purposes. If the intermediate is granted the permission “issue

I haven’t researched this fully yet, but I believe that this is a nuance of x509 and certificate purposes. If the intermediate is granted the permission “issue website/email cert” at the lowest x509 level, then it apparently (TIL) used to be possible to layer in higher-level constraints in order to disable that so as not to disclose it — but when these rules take effect, that kind of exception will no longer be accepted, since intermediates that won’t be issuing web/email certificates shouldn’t be issued with x509 properties that say “I can issue web/email certificates” anyways.