You're forgetting the huge mass of non-browser SSL/TLS clients. Do you see the expressions of surprise about this policy here on HN? These are the world's more

You're forgetting the huge mass of non-browser SSL/TLS clients. Do you see the expressions of surprise about this policy here on HN? These are the world's more informed client application developers. Consider now that your home router's firmware update client, your server's IPMI, and the entire global network for real-time trading of [strategic material] was written by developers to RFCs that told them they had absolutely no reason to implement the Name Constraints extension because if it ever appeared, it was guaranteed to be marked 'critical'.