Libksba does not have support for nameConstraints (see rfc-5280, 4.2.1.10) because it was not required in the TMTTv2 profile we implemented (OID=1.3.6.1.5.5.1.17). We should nevertheless implement this to get closer to PKIX.