Apply a name constraint to an X.509 trust anchor via cross-signing, without that trust anchor's consent. - View it on GitHub