TLS certificate management on Android

That said, while nameConstraints doesn't yet work in enough software to deploy this widely, I'd be interested in the ability to manually tell a browser or other software "allow this root CA, but *only* for subdomains of this domain, not all sites despite what the cert says". That would work nicely for Intranet sites that use a common CA root.