x509 entries in the cert don't help if the cert is designed to sign false server certs... they obviously will not add the restriction to the CA. Browsers defin

x509 entries in the cert don't help if the cert is designed to sign false server certs... they obviously will not add the restriction to the CA. Browsers definitely are in a position to additionally restrict their trust to certs in their store to specific hostnames. But there doesn't seem to be any UI except explicit global trust and distrust.