Wish it were as simple - ultimately having a name-constrained and publicly-trusted CA is the same as having any publicly-trusted CA and comes with a ton of wonderful burdens like audits.
You're essentially running a public CA at that point, and that isn't easy.
You're essentially running a public CA at that point, and that isn't easy.