This is for the case where we want to ensure that an OID is contained by another OID, but not the OID itself. For instance we may want to permit a subtree of ppRegCertExt to be used, but not that tree itself.