Comment by MrDOS

Yes, as I understand it, this sort of problem is what “Name Constraints”[0] were designed to solve. (Well, really, they were intended to be used with corporate internal CAs[1], but there's no reason they wouldn't work more broadly, too.)

[0]: https://www.rfc-editor.org/info/rfc5280/#section-4.2.1.10 [1]: https://utcc.utoronto.ca/~cks/space/blog/tech/TLSInternalCAN...