Function permits_only 

pub fn permits_only(certificate_pem: &str, suffix: &str) -> bool

Is this certificate an authority that can vouch for suffix and nothing else?

Every clause is a separate way the answer could be yes when it should be no, so they are written out rather than folded into one expression: no constraint at all, a constraint on a different suffix, a second permitted subtree beside the right one, an exclusion that changes what the permission means, a constraint a verifier may skip because it is not critical, or an authority that can sign a further authority.