Code signing is another beast all together, in 5280 (and its predecessors). EKU is used to restrict what certificates are good for, this bug explains a behavio

Code signing is another beast all together, in 5280 (and its predecessors). EKU is used to restrict what certificates are good for, this bug explains a behavior the majority of code signing delegation is dependent on - https://bugzilla.mozilla.org/show_bug.cgi?id=321156 https://bugzilla.mozilla.org/show_bug.cgi?id=321156 Basically a parent ca can say, I trust you for S/MIME certificates but not for SSL or code signing -- this is a common scenario. Additionally root programs do not delegate code signing to all roots. Basically the ability to do code signing is rarely delegated to a root and doing so to subordinate CA outside the CAs control should be even rarer.