Scrap that idea. I was right the first time. RFC 5280 says:
The name constraints extension, which MUST be used only in a CA certificate, indicates a name space within which all subject names in subsequent certificates in a certification path MUST be located.Oh well, it was a pleasant notion while it lasted. All of 15 minutes or so. ;)
/psa
smime.p7s
Description: S/MIME Cryptographic Signature
