I agree with Patrick Patterson and Michael Ströder that using the
Certificate Policies extension to control usage of the EE key
"messes with" the CP extension. The policy under which certificates
are issued seems tenuously related, if not completely unrelated,
to the applications which make use of the certificates.
There may be examples where the two are aligned. For example, in the
S-BGP context, we anticipate defining a CP that clearly restricts the
certs issued by registries to be used for S-BGP, as a means of
limiting liability. But, I won't claim that this is a common case.