I think the parent poster meant that if X.509 Name Constraints were widely deployed, Visas CA could be limited to Visa's TLD+1s. In the same way, government aff

I think the parent poster meant that if X.509 Name Constraints were widely deployed, Visas CA could be limited to Visa's TLD+1s. In the same way, government affiliated CAs could be limited to their own country TLDs, or a development CA could be limited to localhost.