Small clarification of name-constrained intermediate CA certs