One problem with wildcard certs is that any host can impersonate any host within the wildcard zone.
It would be great to be able to get a certificate for an intermediary CA, that is limited to one domain. And then use this CA to issue certs as needed.