> I don't understand why name constraints aren't implemented everywhere. They have weird semantics, especially in scenarios with multiple prospective validatio

> I don't understand why name constraints aren't implemented everywhere. They have weird semantics, especially in scenarios with multiple prospective validation paths: path `EE -> ICA' -> ICA'' -> TA` might result in different name constraints than `EE -> ICA' -> ICA''' -> TA`, resulting in hard-to-debug validation errors (or successes) depending on the user's trust store state. (I don't believe that's why Chrome doesn't support them, however. Chrome's stated reason[1] is that they don't support them on user roots because RFC 5280 doesn't require them to, which is IMO a correct reading of the spec.) [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=1072083 https://bugs.chromium.org/p/chromium/issues/detail?id=107208...