This would be for subdomains with their own &quot;sovereignty&quot;; e.g. Tumblr or Wordpress blogs, where the subdomain &quot;owner&quot; could conceivably want to issue their <i>own</i> subdomains, or, heaven forbid, do client-cert signing for their subdomain.