Too limiting: One subject type/CA?

["Anders Rundgren" <anders.rundgren@xxxxxxxxx>]

List,
I'm plotting with a scheme that would benefit a *lot* if CAs restricted
issuance to various subjects (e-mail certs, ID-card-like certs, web-server
certs etc.) to one subject type (and CPS) per CA-cert/key.  It *seems* that
this is the case for most (all?) commercial vendors but I would like to
know if anybody has other input on this.

Actually it becomes very akward for any RP scheme, after accepting
a certain CA, not be able to *easy* figure out if the EE-cert is an identity
certificate or server ditto.   To read and interpret various non-standard
(de-facto-wise rather than w.r.t. PKIX) extensons is not an option if
we are talking open PKI.

Anders