Maybe one day I'll be able to use certbot to provision those sorts of certs fully automatically.

Over the years their requirements have become way less aggressive. It used to be that such certs were under mostly the same requirements as a full CA cert, but now it just requires self assessment on the part of the issuer and issuee. But that's still too much for end users.

I do hope one day that the CA/Browser Forum permit the issuance of name constrained CA certs to end users.