NameConstraints used to break in Safari: if you didn't set them mandatory, the constraints would be ignored and you could sign anything; if you set them mandatory, the certificate wouldn't validate. But it looks like support was added in 10.13.3, circa 2018, so probably good to go.

Might break some things, and I'm not aware of any mainstream uses, but obviously it'd be really handy if it's usable.