In the end, the IETF (RFC 5280), browsers and CAs run fast and loose, so it probably does not matter what key usage you provide.

This is actually correct, standards-compliant behavior. A *.xyz.net wildcard certificate is valid for abc.xyz.net or docker.xyz.net, but not docker.abc.xyz.net.

This module is similar to JSX, but provided as a standards-compliant ES6 tagged template string function.

Firefox is the most compliant with the proposed standard, and is, therefore, your best place to start when developing browser extensions