try implementing the CA x509.Certificate constraints

[glvnst]

Upstream issue 26 has an interesting suggestion which could limit the blast radius of a file disclosure of the CA key. I suspect that generally file disclosure is a bit easier for an attacker to accomplish than full local compromise but I don't have anything to back that up.

I'd consider trying implementations of PermittedDNSDomains and PermittedIPRanges and just hooking PermittedDNSDomainsCritical to the presence of values in either.

x509.Certificate has these related fields:

    // Name constraints
    PermittedDNSDomainsCritical bool // if true then the name constraints are marked critical.
    PermittedDNSDomains         []string
    ExcludedDNSDomains          []string
    PermittedIPRanges           []*net.IPNet
    ExcludedIPRanges            []*net.IPNet
    PermittedEmailAddresses     []string
    ExcludedEmailAddresses      []string
    PermittedURIDomains         []string
    ExcludedURIDomains          []string