Comment by notanote

The ability exists. Such constraints aren't used very often for root certificates though, as far as I can tell. The Japanese Government CA which was mentioned in the discussions around TrustCor was constrained to .go.jp.