There are discussion in CA/B forums for root and intermediate CAs with technically scoped issue policies.

For example, a government could be an intermediate CA, and have it technically limited only to issue certificates for `*.gov.CCTLD` domains.